70c5158096c8344b9f41c1016211951d1834a8b9d59107fbf471054d3cf58fa2

Resubmissions

22-02-2022 16:12

220222-tngfasahc2 10

17-01-2022 15:06

220117-sg5zmsagg4 10

Analysis

max time kernel
4264969s
max time network
27s
platform
windows10-2004_x64
resource
win10v2004-en-20220113
submitted
17-01-2022 15:06

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

core.bat
Size

184B
MD5

c540eb5e82dc4dd90cd65bc5a8580745
SHA1

3c009abc357c266b1eac6cee5efde0faf69f8afd
SHA256

6325c1d867acf95f2786c760ad517fefa9f213d8beb76e422f6c2fea88e5b91c
SHA512

5b0f0a797d0c8c4a5f53e329ce40d5e9f608753626ca67e94cfbe0c1bcc8086c9145f8093950f8edcd69307e353dffaf30025d614778ebc4aeac66946b33c8db

Score

1^/10

Malware Config

Signatures

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

Processes:

MusNotification.exe

description	ioc	process
Key opened	\Registry\Machine\HARDWARE\DESCRIPTION\System\CentralProcessor\0	MusNotification.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	MusNotification.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

Processes:

MusNotification.exe

description pid process

Token: SeShutdownPrivilege 720 MusNotification.exe
Token: SeCreatePagefilePrivilege 720 MusNotification.exe
Suspicious use of WriteProcessMemory 2 IoCs

Processes:

cmd.exe

description pid process target process

PID 1496 wrote to memory of 1724 1496 cmd.exe rundll32.exe
PID 1496 wrote to memory of 1724 1496 cmd.exe rundll32.exe

description	pid	process
Token: SeShutdownPrivilege	720	MusNotification.exe
Token: SeCreatePagefilePrivilege	720	MusNotification.exe

description	pid	process	target process
PID 1496 wrote to memory of 1724	1496	cmd.exe	rundll32.exe
PID 1496 wrote to memory of 1724	1496	cmd.exe	rundll32.exe

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\core.bat"
1⤵
- Suspicious use of WriteProcessMemory
PID:1496
- C:\Windows\system32\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\scan_x32.tmp,DllMain /i="license.dat"
  2⤵
  PID:1724

C:\Windows\system32\MusNotification.exe
C:\Windows\system32\MusNotification.exe
1⤵
- Checks processor information in registry
- Suspicious use of AdjustPrivilegeToken
PID:720

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1724-130-0x0000000000000000-mapping.dmp

Download