Analysis
-
max time kernel
92s -
max time network
131s -
platform
windows10-2004_x64 -
resource
win10v2004-20240704-en -
resource tags
arch:x64arch:x86image:win10v2004-20240704-enlocale:en-usos:windows10-2004-x64system -
submitted
05-07-2024 01:01
Static task
static1
Behavioral task
behavioral1
Sample
84617e9c081b6b585582d2589aace5a0a7887283f9488b5a6d05906f94116f36.bat
Resource
win7-20240611-en
Behavioral task
behavioral2
Sample
84617e9c081b6b585582d2589aace5a0a7887283f9488b5a6d05906f94116f36.bat
Resource
win10v2004-20240704-en
General
-
Target
84617e9c081b6b585582d2589aace5a0a7887283f9488b5a6d05906f94116f36.bat
-
Size
3.4MB
-
MD5
07f9549ba0e65bb2bd47fcf55c60a608
-
SHA1
50f97f17245b1967ae322f5a72f48184db4932fa
-
SHA256
84617e9c081b6b585582d2589aace5a0a7887283f9488b5a6d05906f94116f36
-
SHA512
d9c2e350d2e963b64c6da7519cdbf15a56a61131098d608721d2e0773e6632b4cb89b90165b212b83b271b5f136539dfe3586dbeef8db6bedc0d358b8d02cd41
-
SSDEEP
1536:r9M37hEimNW4QbAjC5SMd0aF00kd5Regk1IcIoJkFVcKaoowmgd27/:IENXCbiae0kjRep6VcEo/gUT
Malware Config
Signatures
-
Hide Artifacts: Ignore Process Interrupts 1 TTPs 1 IoCs
Command interpreters often include specific commands/flags that ignore errors and other hangups.
-
Suspicious behavior: EnumeratesProcesses 3 IoCs
Processes:
powershell.exepid process 2464 powershell.exe 2464 powershell.exe 2464 powershell.exe -
Suspicious use of AdjustPrivilegeToken 22 IoCs
Processes:
powershell.exedescription pid process Token: SeDebugPrivilege 2464 powershell.exe Token: SeIncreaseQuotaPrivilege 2464 powershell.exe Token: SeSecurityPrivilege 2464 powershell.exe Token: SeTakeOwnershipPrivilege 2464 powershell.exe Token: SeLoadDriverPrivilege 2464 powershell.exe Token: SeSystemProfilePrivilege 2464 powershell.exe Token: SeSystemtimePrivilege 2464 powershell.exe Token: SeProfSingleProcessPrivilege 2464 powershell.exe Token: SeIncBasePriorityPrivilege 2464 powershell.exe Token: SeCreatePagefilePrivilege 2464 powershell.exe Token: SeBackupPrivilege 2464 powershell.exe Token: SeRestorePrivilege 2464 powershell.exe Token: SeShutdownPrivilege 2464 powershell.exe Token: SeDebugPrivilege 2464 powershell.exe Token: SeSystemEnvironmentPrivilege 2464 powershell.exe Token: SeRemoteShutdownPrivilege 2464 powershell.exe Token: SeUndockPrivilege 2464 powershell.exe Token: SeManageVolumePrivilege 2464 powershell.exe Token: 33 2464 powershell.exe Token: 34 2464 powershell.exe Token: 35 2464 powershell.exe Token: 36 2464 powershell.exe -
Suspicious use of WriteProcessMemory 4 IoCs
Processes:
cmd.exedescription pid process target process PID 4756 wrote to memory of 5096 4756 cmd.exe findstr.exe PID 4756 wrote to memory of 5096 4756 cmd.exe findstr.exe PID 4756 wrote to memory of 2464 4756 cmd.exe powershell.exe PID 4756 wrote to memory of 2464 4756 cmd.exe powershell.exe
Processes
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\84617e9c081b6b585582d2589aace5a0a7887283f9488b5a6d05906f94116f36.bat"1⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\findstr.exefindstr /i "echo" "C:\Users\Admin\AppData\Local\Temp\84617e9c081b6b585582d2589aace5a0a7887283f9488b5a6d05906f94116f36.bat"2⤵
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell.exe -NoLogo -NoProfile -ExecutionPolicy Bypass -Command "if((gcim Win32_PhysicalMemory | measure -Property capacity -Sum).sum /1gb -lt 4) {spps -f -n 'cmd' -ErrorAction SilentlyContinue;exit 1}"2⤵
- Hide Artifacts: Ignore Process Interrupts
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_mulwksz3.12v.ps1Filesize
60B
MD5d17fe0a3f47be24a6453e9ef58c94641
SHA16ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA25696ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
SHA5125b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
-
C:\Users\Admin\AppData\Local\Temp\kdotzASik.batFilesize
231B
MD51fdf1ddeddb7b144e8f93262144a56d1
SHA1cfcd1c4ebcf5e83a583ac8688aa5062abf57c8d1
SHA256c71e50112a771b021417874d43158b7f2edb7c6f17102898c9015cef675e8917
SHA51291ab8c53c36af4f34db66a4f26261e2dd92d9b2519291380f9a07aaa00a820788342314ea623dfae2c1dd55627c89e732a366a85086326ca3b04893cb4f626d5
-
memory/2464-11-0x00007FF991AC3000-0x00007FF991AC5000-memory.dmpFilesize
8KB
-
memory/2464-17-0x00000216BAB70000-0x00000216BAB92000-memory.dmpFilesize
136KB
-
memory/2464-22-0x00000216BACF0000-0x00000216BAD1A000-memory.dmpFilesize
168KB
-
memory/2464-23-0x00000216BACF0000-0x00000216BAD14000-memory.dmpFilesize
144KB
-
memory/2464-24-0x00007FF991AC0000-0x00007FF992581000-memory.dmpFilesize
10.8MB
-
memory/2464-25-0x00007FF991AC0000-0x00007FF992581000-memory.dmpFilesize
10.8MB
-
memory/2464-26-0x00007FF991AC0000-0x00007FF992581000-memory.dmpFilesize
10.8MB
-
memory/2464-28-0x00007FF991AC0000-0x00007FF992581000-memory.dmpFilesize
10.8MB