91bbeb187c359460b0a94dab5b3f957ddeaeff4cf6ec0ef4e070624b406a34d6

Analysis

max time kernel
32s
max time network
45s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
11-10-2022 11:53

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

1c4O8e1j4.bat
Size

1.0MB
MD5

668c1ef4ab40beaba3404907d01f570a
SHA1

1fb136dffc6a9a22a8606c506362f3f63d0b8a65
SHA256

91bbeb187c359460b0a94dab5b3f957ddeaeff4cf6ec0ef4e070624b406a34d6
SHA512

64a6232c9afc659b1063289c2f747dffa91f970ea4b715129963fe30f64fa0ceb01cae049d22d1643e030587d09675de4ed4507b53f725ec5e4b3f167fffbec0
SSDEEP

384:l33333333333333333333333333333333333333333333333333333333333333O:E

Score

7^/10

Malware Config

Signatures

Deletes itself 1 IoCs

pid	Process
588	cmd.exe

Kills process with taskkill 10 IoCs

evasion

pid	Process
288	taskkill.exe
1396	taskkill.exe
536	taskkill.exe
2020	taskkill.exe
1924	taskkill.exe
980	taskkill.exe
2024	taskkill.exe
320	taskkill.exe
1904	taskkill.exe
1824	taskkill.exe

Suspicious use of AdjustPrivilegeToken 10 IoCs

description	pid	Process
Token: SeDebugPrivilege	536	taskkill.exe
Token: SeDebugPrivilege	2020	taskkill.exe
Token: SeDebugPrivilege	2024	taskkill.exe
Token: SeDebugPrivilege	1924	taskkill.exe
Token: SeDebugPrivilege	320	taskkill.exe
Token: SeDebugPrivilege	980	taskkill.exe
Token: SeDebugPrivilege	288	taskkill.exe
Token: SeDebugPrivilege	1396	taskkill.exe
Token: SeDebugPrivilege	1904	taskkill.exe
Token: SeDebugPrivilege	1824	taskkill.exe

Suspicious use of WriteProcessMemory 33 IoCs

description	pid	Process	procid_target
PID 1520 wrote to memory of 536	1520	cmd.exe	29
PID 1520 wrote to memory of 536	1520	cmd.exe	29
PID 1520 wrote to memory of 536	1520	cmd.exe	29
PID 1520 wrote to memory of 2020	1520	cmd.exe	31
PID 1520 wrote to memory of 2020	1520	cmd.exe	31
PID 1520 wrote to memory of 2020	1520	cmd.exe	31
PID 1520 wrote to memory of 2024	1520	cmd.exe	32
PID 1520 wrote to memory of 2024	1520	cmd.exe	32
PID 1520 wrote to memory of 2024	1520	cmd.exe	32
PID 1520 wrote to memory of 1924	1520	cmd.exe	33
PID 1520 wrote to memory of 1924	1520	cmd.exe	33
PID 1520 wrote to memory of 1924	1520	cmd.exe	33
PID 1520 wrote to memory of 320	1520	cmd.exe	34
PID 1520 wrote to memory of 320	1520	cmd.exe	34
PID 1520 wrote to memory of 320	1520	cmd.exe	34
PID 1520 wrote to memory of 980	1520	cmd.exe	35
PID 1520 wrote to memory of 980	1520	cmd.exe	35
PID 1520 wrote to memory of 980	1520	cmd.exe	35
PID 1520 wrote to memory of 288	1520	cmd.exe	36
PID 1520 wrote to memory of 288	1520	cmd.exe	36
PID 1520 wrote to memory of 288	1520	cmd.exe	36
PID 1520 wrote to memory of 1396	1520	cmd.exe	37
PID 1520 wrote to memory of 1396	1520	cmd.exe	37
PID 1520 wrote to memory of 1396	1520	cmd.exe	37
PID 1520 wrote to memory of 1904	1520	cmd.exe	38
PID 1520 wrote to memory of 1904	1520	cmd.exe	38
PID 1520 wrote to memory of 1904	1520	cmd.exe	38
PID 1520 wrote to memory of 1824	1520	cmd.exe	39
PID 1520 wrote to memory of 1824	1520	cmd.exe	39
PID 1520 wrote to memory of 1824	1520	cmd.exe	39
PID 1520 wrote to memory of 588	1520	cmd.exe	40
PID 1520 wrote to memory of 588	1520	cmd.exe	40
PID 1520 wrote to memory of 588	1520	cmd.exe	40

C:\Windows\system32\cmd.exe
cmd /c "C:\Users\Admin\AppData\Local\Temp\1c4O8e1j4.bat"
1⤵
- Suspicious use of WriteProcessMemory
PID:1520
- C:\Windows\system32\taskkill.exe
  taskkill /F /IM win.exe
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:536
- C:\Windows\system32\taskkill.exe
  taskkill /F /IM win.exe
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:2020
- C:\Windows\system32\taskkill.exe
  taskkill /F /IM win.exe
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:2024
- C:\Windows\system32\taskkill.exe
  taskkill /F /IM win.exe
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:1924
- C:\Windows\system32\taskkill.exe
  taskkill /F /IM win.exe
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:320
- C:\Windows\system32\taskkill.exe
  taskkill /F /IM win.exe
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:980
- C:\Windows\system32\taskkill.exe
  taskkill /F /IM win.exe
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:288
- C:\Windows\system32\taskkill.exe
  taskkill /F /IM win.exe
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:1396
- C:\Windows\system32\taskkill.exe
  taskkill /F /IM win.exe
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:1904
- C:\Windows\system32\taskkill.exe
  taskkill /F /IM win.exe
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:1824
- C:\Windows\system32\cmd.exe
  cmd /c DEL "C:\Users\Admin\AppData\Local\Temp\1c4O8e1j4.bat"
  2⤵
  - Deletes itself
  PID:588

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/288-60-0x0000000000000000-mapping.dmp

Download
memory/320-58-0x0000000000000000-mapping.dmp

Download
memory/536-54-0x0000000000000000-mapping.dmp

Download
memory/588-64-0x0000000000000000-mapping.dmp

Download
memory/980-59-0x0000000000000000-mapping.dmp

Download
memory/1396-61-0x0000000000000000-mapping.dmp

Download
memory/1824-63-0x0000000000000000-mapping.dmp

Download
memory/1904-62-0x0000000000000000-mapping.dmp

Download
memory/1924-57-0x0000000000000000-mapping.dmp

Download
memory/2020-55-0x0000000000000000-mapping.dmp

Download
memory/2024-56-0x0000000000000000-mapping.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads