cf4cf0f064bbd1115fdee0971c7ffc9a474984eeda8107040589b425ae1a6605

General

Target

P0#1307020 P2.bat.exe
Size

341KB
MD5

735f03674a0a65c14088e18657694fe9
SHA1

6e2d3a2e7bb0220054c8fc2ea8272f6d9babd0bb
SHA256

cf4cf0f064bbd1115fdee0971c7ffc9a474984eeda8107040589b425ae1a6605
SHA512

1a74849aab621c866076a5660e16fbcc569085701858cba054d9ad67f2ac3696c9dc75da9f3564f5e71cc19c4c53c3a8b6993c937ee6f063c19bb84668f4e699

Score

1^/10

Suspicious behavior: EnumeratesProcesses 5 IoCs

Creates scheduled task(s) 1 TTPs 1 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

Scheduled Task

pid	Process
1812	schtasks.exe

Suspicious use of WriteProcessMemory 24 IoCs

description	pid	Process	procid_target
PID 1092 wrote to memory of 1812	1092	P0#1307020 P2.bat.exe	26
PID 1092 wrote to memory of 1812	1092	P0#1307020 P2.bat.exe	26
PID 1092 wrote to memory of 1812	1092	P0#1307020 P2.bat.exe	26
PID 1092 wrote to memory of 1812	1092	P0#1307020 P2.bat.exe	26
PID 1092 wrote to memory of 1776	1092	P0#1307020 P2.bat.exe	28
PID 1092 wrote to memory of 1776	1092	P0#1307020 P2.bat.exe	28
PID 1092 wrote to memory of 1776	1092	P0#1307020 P2.bat.exe	28
PID 1092 wrote to memory of 1776	1092	P0#1307020 P2.bat.exe	28
PID 1092 wrote to memory of 1764	1092	P0#1307020 P2.bat.exe	29
PID 1092 wrote to memory of 1764	1092	P0#1307020 P2.bat.exe	29
PID 1092 wrote to memory of 1764	1092	P0#1307020 P2.bat.exe	29
PID 1092 wrote to memory of 1764	1092	P0#1307020 P2.bat.exe	29
PID 1092 wrote to memory of 1772	1092	P0#1307020 P2.bat.exe	30
PID 1092 wrote to memory of 1772	1092	P0#1307020 P2.bat.exe	30
PID 1092 wrote to memory of 1772	1092	P0#1307020 P2.bat.exe	30
PID 1092 wrote to memory of 1772	1092	P0#1307020 P2.bat.exe	30
PID 1092 wrote to memory of 1756	1092	P0#1307020 P2.bat.exe	31
PID 1092 wrote to memory of 1756	1092	P0#1307020 P2.bat.exe	31
PID 1092 wrote to memory of 1756	1092	P0#1307020 P2.bat.exe	31
PID 1092 wrote to memory of 1756	1092	P0#1307020 P2.bat.exe	31
PID 1092 wrote to memory of 524	1092	P0#1307020 P2.bat.exe	32
PID 1092 wrote to memory of 524	1092	P0#1307020 P2.bat.exe	32
PID 1092 wrote to memory of 524	1092	P0#1307020 P2.bat.exe	32
PID 1092 wrote to memory of 524	1092	P0#1307020 P2.bat.exe	32

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	1092	P0#1307020 P2.bat.exe

C:\Users\Admin\AppData\Local\Temp\P0#1307020 P2.bat.exe
"C:\Users\Admin\AppData\Local\Temp\P0#1307020 P2.bat.exe"
1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
- Suspicious use of AdjustPrivilegeToken
PID:1092
- C:\Windows\SysWOW64\schtasks.exe
  "C:\Windows\System32\schtasks.exe" /Create /TN "Updates\wWOEHJ" /XML "C:\Users\Admin\AppData\Local\Temp\tmpC2A2.tmp"
  2⤵
  - Creates scheduled task(s)
  PID:1812
- C:\Users\Admin\AppData\Local\Temp\P0#1307020 P2.bat.exe
  "{path}"
  2⤵
  PID:1776
- C:\Users\Admin\AppData\Local\Temp\P0#1307020 P2.bat.exe
  "{path}"
  2⤵
  PID:1764
- C:\Users\Admin\AppData\Local\Temp\P0#1307020 P2.bat.exe
  "{path}"
  2⤵
  PID:1772
- C:\Users\Admin\AppData\Local\Temp\P0#1307020 P2.bat.exe
  "{path}"
  2⤵
  PID:1756
- C:\Users\Admin\AppData\Local\Temp\P0#1307020 P2.bat.exe
  "{path}"
  2⤵
  PID:524