51123b4998b76fdfa04500d3d8979860e6c5927b49ff05b517f3705fb992efdf

General

Target
FallenOptimizerv2.bat
Size 50KB
Sample261023-292mcsvz7r
SHA256 51123b4998b76fdfa04500d3d8979860e6c5927b49ff05b517f3705fb992efdf
MD5 f4e7267aa46852ad0630ca54bb76011a
SHA1 91e59ccd882263bfe26c36e049a0c1acfd5a79d4
SHA512 7488f7d7d0421ce3bb4557be2c9197f324127111d7b5dc2d67b74857331e1ebbb03b5075c4379ad219478a5aeed9d1780d446ed484142c6b20fbe934434001c2
SSDEEP 768:vmkFEMgjE9jV8AORKklpu/+b/BmpHVWboL3XhlJw:+ygmV3OTLu/+t9oLBl+
TLSH
T129337232AD86CC2632F2CB3ED21A6534FB2473873A10555471ECB05D2BEDBA652BC176
MD5 SHA1 SHA512 SSDEEP TLSH

Score

6^/10

defense_evasion execution persistence

Malware Config

Signatures

Command and Scripting Interpreter: PowerShell 1 TTPs 2 IoCs

Using powershell.exe command.

execution

PowerShell

T1059.001

pid	Process
988	powershell.exe
2016	powershell.exe

Power Settings 1 TTPs 2 IoCs

powercfg controls all configurable power system settings on a Windows system and can be abused to prevent an infected host from locking or shutting down.

persistence

Power Settings

T1653

pid	Process
2568	powercfg.exe
2888	powercfg.exe

Hide Artifacts: Ignore Process Interrupts 1 TTPs 2 IoCs

Command interpreters often include specific commands/flags that ignore errors and other hangups.

defense_evasion

Ignore Process Interrupts

T1564.011

pid	Process
988	powershell.exe
2016	powershell.exe

Executes a command shell one-liner 1 TTPs 2 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
3064	cmd.exe
4528	cmd.exe

Suspicious behavior: EnumeratesProcesses 4 IoCs

pid	Process
988	powershell.exe
988	powershell.exe
2016	powershell.exe
2016	powershell.exe

Suspicious use of AdjustPrivilegeToken 6 IoCs

description	pid	Process
Token: SeDebugPrivilege	988	powershell.exe
Token: SeDebugPrivilege	2016	powershell.exe
Token: SeShutdownPrivilege	2888	powercfg.exe
Token: SeCreatePagefilePrivilege	2888	powercfg.exe
Token: SeShutdownPrivilege	2568	powercfg.exe
Token: SeCreatePagefilePrivilege	2568	powercfg.exe

Suspicious use of WriteProcessMemory 10 IoCs

description	pid	Process	procid_target
PID 4528 wrote to memory of 2344	4528	cmd.exe	85
PID 4528 wrote to memory of 1560	4528	cmd.exe	86
PID 4528 wrote to memory of 2356	4528	cmd.exe	87
PID 4528 wrote to memory of 3064	4528	cmd.exe	88
PID 3064 wrote to memory of 1264	3064	cmd.exe	89
PID 3064 wrote to memory of 2648	3064	cmd.exe	90
PID 4528 wrote to memory of 988	4528	cmd.exe	91
PID 4528 wrote to memory of 2016	4528	cmd.exe	92
PID 4528 wrote to memory of 2888	4528	cmd.exe	104
PID 4528 wrote to memory of 2568	4528	cmd.exe	105

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\FallenOptimizerv2.bat"
1⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:4528
- C:\Windows\system32\fltMC.exe
  fltmc
  2⤵
  PID:2344
- C:\Windows\system32\reg.exe
  reg add "HKCU\Console" /v VirtualTerminalLevel /t REG_DWORD /d 1 /f
  2⤵
  PID:1560
- C:\Windows\system32\chcp.com
  chcp 65001
  2⤵
  PID:2356
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c echo prompt $E | cmd
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:3064
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /S /D /c" echo prompt $E "
    3⤵
    PID:1264
- - C:\Windows\system32\cmd.exe
    cmd
    3⤵
    PID:2648
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell -NoProfile -ExecutionPolicy Bypass -Command "$t = @'" + [Environment]::NewLine + "[Console]::OutputEncoding = [System.Text.Encoding]::UTF8" + [Environment]::NewLine + "$ESC = [char]27" + [Environment]::NewLine + "$cRst = ""$ESC[0m""" + [Environment]::NewLine + "$cDim = ""$ESC[38;2;139;139;158m""" + [Environment]::NewLine + "$cOk = ""$ESC[38;2;34;197;94m""" + [Environment]::NewLine + "$cWrn = ""$ESC[38;2;245;158;11m""" + [Environment]::NewLine + "$cBad = ""$ESC[38;2;239;68;68m""" + [Environment]::NewLine + "$cAcc = ""$ESC[38;2;124;58;237m""" + [Environment]::NewLine + "$cTxt = ""$ESC[38;2;243;244;246m""" + [Environment]::NewLine + "try {" + [Environment]::NewLine + " $os = Get-CimInstance Win32_OperatingSystem -ErrorAction SilentlyContinue" + [Environment]::NewLine + " $cpu = (Get-CimInstance Win32_Processor -ErrorAction SilentlyContinue | Measure-Object -Property LoadPercentage -Average).Average" + [Environment]::NewLine + " if ($null -eq $cpu) { $cpu = 0 }" + [Environment]::NewLine + " $cpu = [math]::Round($cpu)" + [Environment]::NewLine + "} catch { $cpu = 0 }" + [Environment]::NewLine + "try {" + [Environment]::NewLine + " $totalRam = [math]::Round($os.TotalVisibleMemorySize / 1MB, 1)" + [Environment]::NewLine + " $freeRam = [math]::Round($os.FreePhysicalMemory / 1MB, 1)" + [Environment]::NewLine + " $usedRam = [math]::Round($totalRam - $freeRam, 1)" + [Environment]::NewLine + " $ramPct = [math]::Round(($usedRam / $totalRam) * 100)" + [Environment]::NewLine + "} catch { $totalRam=16; $usedRam=8; $ramPct=50 }" + [Environment]::NewLine + "$procs = Get-Process -ErrorAction SilentlyContinue" + [Environment]::NewLine + "$procCount = $procs.Count" + [Environment]::NewLine + "$threadCount = ($procs | Measure-Object -Property Threads -Sum).Sum" + [Environment]::NewLine + "try {" + [Environment]::NewLine + " $up = (Get-Date) - $os.LastBootUpTime" + [Environment]::NewLine + " $upStr = ""{0}d {1}h {2}m"" -f $up.Days, $up.Hours, $up.Minutes" + [Environment]::NewLine + "} catch { $upStr = ""N/A"" }" + [Environment]::NewLine + "$pingStr = ""N/A""" + [Environment]::NewLine + "try {" + [Environment]::NewLine + " $p = Test-Connection 1.1.1.1 -Count 1 -TimeoutSeconds 1 -ErrorAction SilentlyContinue" + [Environment]::NewLine + " if ($p) { $pingStr = ""$($p.ResponseTime) ms"" }" + [Environment]::NewLine + "} catch { $pingStr = ""Timeout"" }" + [Environment]::NewLine + "$gpuName = ""N/A""; $gpuLoad = ""N/A""; $gpuTemp = ""N/A""; $gpuFan = ""N/A""; $gpuVram = ""N/A""; $gpuLoadNum = 0" + [Environment]::NewLine + "$nvidiaSmi = Get-Command ""nvidia-smi"" -ErrorAction SilentlyContinue" + [Environment]::NewLine + "if (-not $nvidiaSmi) {" + [Environment]::NewLine + " if (Test-Path ""C:Program FilesNVIDIA CorporationNVSMI
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Hide Artifacts: Ignore Process Interrupts
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:988
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell -NoProfile -ExecutionPolicy Bypass -Command "$b = @'" + [Environment]::NewLine + "while ($true) {" + [Environment]::NewLine + " $proc = Get-Process -Name ""FortniteClient-Win64-Shipping"" -ErrorAction SilentlyContinue" + [Environment]::NewLine + " if ($proc) {" + [Environment]::NewLine + " foreach ($p in $proc) {" + [Environment]::NewLine + " try {" + [Environment]::NewLine + " if ($p.PriorityClass -ne [System.Diagnostics.ProcessPriorityClass]::High) {" + [Environment]::NewLine + " $p.PriorityClass = [System.Diagnostics.ProcessPriorityClass]::High" + [Environment]::NewLine + " Add-Content ""$env:LOCALAPPDATAFallenOptimizerallen.log"" (""["" + (Get-Date).ToString() + ""] [AUTOBOOST] Set Fortnite to High Priority (PID "" + $p.Id + "")"")" + [Environment]::NewLine + " }" + [Environment]::NewLine + " } catch {}" + [Environment]::NewLine + " }" + [Environment]::NewLine + " }" + [Environment]::NewLine + " Start-Sleep -Seconds 5" + [Environment]::NewLine + "}" + [Environment]::NewLine + "'@; [System.IO.File]::WriteAllText('C:\Users\Admin\AppData\Local\FallenOptimizer\autoboost.ps1', $b, [System.Text.Encoding]::UTF8);"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Hide Artifacts: Ignore Process Interrupts
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:2016
- C:\Windows\system32\powercfg.exe
  powercfg -duplicatescheme 8c5e7fda-e8bf-4a96-9a85-a6e23a8c635c
  2⤵
  - Power Settings
  - Suspicious use of AdjustPrivilegeToken
  PID:2888
- C:\Windows\system32\powercfg.exe
  powercfg -setactive 8c5e7fda-e8bf-4a96-9a85-a6e23a8c635c
  2⤵
  - Power Settings
  - Suspicious use of AdjustPrivilegeToken
  PID:2568

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

2

T1059

PowerShell

1

T1059.001

Windows Command Shell

1

T1059.003

Persistence

Power Settings

1

T1653

Privilege Escalation

Defense Evasion

Hide Artifacts

1

T1564

Ignore Process Interrupts

1

T1564.011

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

powershell.exe.log

Path C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.log
Size 2KB
SHA256 84739c608a73509419748e4e20e6cc4e1846056c3fe1929a8300d5a1a488202f
MD5 d85ba6ff808d9e5444a4b369f5bc2730
SHA1 31aa9d96590fff6981b315e0b391b575e4c0804a
SHA512 8c414eb55b45212af385accc16d9d562adba2123583ce70d22b91161fe878683845512a78f04dedd4ea98ed9b174dbfa98cf696370598ad8e6fbd1e714f1f249
TLSH
T1CE51EE323375B1E888167F071E681A8053BF4355EA94AF1CB698621ED93641B9F222F3
MD5 SHA1 SHA512 TLSH

Submit Download

StartupProfileData-NonInteractive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 944B
SHA256 c695bd38b90537e2862d2f2e90f3401b9dc14af0792251ee897df2d0b0dc9467
MD5 3c99ea4e015d0033c75a3c50304499b1
SHA1 594e0bedf19484deec3202fd44225ea7d52cd888
SHA512 4b0c1d820db21868ec5885f11b6c5986d6ae691f5fda350b8004f8e8972da7b404b9a4cbcb4ed6bb5cf9a03829c99879cb484f7a857339d0c9fb4f9fffb2d46b
TLSH
T181112223F38C8920CC96163A509DAC5172B586DB81AEDF9F7FC0C210A1BF584CB61294
MD5 SHA1 SHA512 TLSH

Submit Download

__PSScriptPolicyTest_cjdornnf.2ly.ps1

Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_cjdornnf.2ly.ps1
Size 60B
SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
MD5 d17fe0a3f47be24a6453e9ef58c94641
SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
TLSH
T177A02228CC303B200020C0080A000002C00B800C080C8C0220000A00B20B820002F080
MD5 SHA1 SHA512 TLSH

Submit Download

memory/988-1-0x000001B051870000-0x000001B051880000-memory.dmp

Download

memory/988-2-0x000001B051870000-0x000001B051880000-memory.dmp

Download

memory/988-10-0x000001B06A270000-0x000001B06A292000-memory.dmp

Download

memory/988-11-0x000001B051870000-0x000001B051880000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads