a532ef74cfbe55a5d4cba2e9407ea4951328797d94e30c4160664d3536cb13d2

Analysis

max time kernel
44s
max time network
49s
platform
windows7_x64
resource
win7-20220901-en
resource tags

arch:x64arch:x86image:win7-20220901-enlocale:en-usos:windows7-x64system
submitted
03-10-2022 05:27

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

StopUpdates10 Win10Զ¹رչ_v3.1.101 Я/uninstall-guard.bat
Size

16B
MD5

1439b8c9de2e8368dca861f4476ecf3f
SHA1

19338762144ed068496be8652e64f0594e1f4150
SHA256

ec8af7eaf76519a0dda10acf5a2bcb76cd122514b6512596024fae4735470bd1
SHA512

cf45797f81a8e265cd2bc7ff5120409713f2401a9e6bd6fd9400f4108e71760a7bf81e93465e1b80af6c266a8e7be8fcc5ddb0d9beb10bcf8348f2925ddd7423

Score

8^/10

evasion

Malware Config

Signatures

Stops running service(s) 3 TTPs
evasion

Modify Existing Service
T1031

Impair Defenses
T1562

Service Stop
T1489
Launches sc.exe 1 IoCs
Sc.exe is a Windows utlilty to control services on the system.

Processes:

sc.exe

pid process

1992 sc.exe
Suspicious behavior: CmdExeWriteProcessMemorySpam 1 IoCs

Processes:

SU10Guard.exe

pid process

1688 SU10Guard.exe

pid	process
1992	sc.exe

pid	process
1688	SU10Guard.exe

Suspicious use of WriteProcessMemory 14 IoCs

Processes:

cmd.exeSU10Guard.exe

description	pid	process	target process
PID 2024 wrote to memory of 1688	2024	cmd.exe	SU10Guard.exe
PID 2024 wrote to memory of 1688	2024	cmd.exe	SU10Guard.exe
PID 2024 wrote to memory of 1688	2024	cmd.exe	SU10Guard.exe
PID 2024 wrote to memory of 1688	2024	cmd.exe	SU10Guard.exe
PID 2024 wrote to memory of 1688	2024	cmd.exe	SU10Guard.exe
PID 2024 wrote to memory of 1688	2024	cmd.exe	SU10Guard.exe
PID 2024 wrote to memory of 1688	2024	cmd.exe	SU10Guard.exe
PID 1688 wrote to memory of 1992	1688	SU10Guard.exe	sc.exe
PID 1688 wrote to memory of 1992	1688	SU10Guard.exe	sc.exe
PID 1688 wrote to memory of 1992	1688	SU10Guard.exe	sc.exe
PID 1688 wrote to memory of 1992	1688	SU10Guard.exe	sc.exe
PID 1688 wrote to memory of 1992	1688	SU10Guard.exe	sc.exe
PID 1688 wrote to memory of 1992	1688	SU10Guard.exe	sc.exe
PID 1688 wrote to memory of 1992	1688	SU10Guard.exe	sc.exe

C:\Windows\system32\cmd.exe
cmd /c "C:\Users\Admin\AppData\Local\Temp\StopUpdates10 Win10Զ¹رչ_v3.1.101 Я\uninstall-guard.bat"
1⤵
- Suspicious use of WriteProcessMemory
PID:2024

C:\Users\Admin\AppData\Local\Temp\StopUpdates10 Win10Զ¹رչ_v3.1.101 Я\SU10Guard.exe
SU10Guard.exe -u
2⤵
- Suspicious behavior: CmdExeWriteProcessMemorySpam
- Suspicious use of WriteProcessMemory
PID:1688

C:\Windows\SysWOW64\sc.exe
sc.exe stop SU10Guard
3⤵
- Launches sc.exe
PID:1992

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Modify Existing Service

T1031

Privilege Escalation

Defense Evasion

Impair Defenses

T1562

Credential Access

Discovery

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Service Stop

T1489

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1688-54-0x0000000000000000-mapping.dmp

Download
memory/1688-55-0x00000000766D1000-0x00000000766D3000-memory.dmp

Filesize
8KB

Download
memory/1992-56-0x0000000000000000-mapping.dmp

Download