f7f336955fa601fcd9ecb0e30911e6543882b2027dcbd27ac307d25fabd342db

Analysis

max time kernel
27s
max time network
30s
platform
windows7_x64
resource
win7-20230220-en
resource tags

arch:x64arch:x86image:win7-20230220-enlocale:en-usos:windows7-x64system
submitted
22-03-2023 04:50

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

Meta Unban/Cleaners/full deep cleaner by nigga mhatt lol.bat
Size

902KB
MD5

602ac0bd731b2615933dde1442e96ff7
SHA1

586be9b5bb086aa301eea7df5ee998390756b912
SHA256

97c781dfaa813232a8d13f7dcdfd1490f355ab85823b2cd73b9dd259d3a1ad07
SHA512

d5cee12b3c99cae442808c463636faa0f96cdae24d6caff13fd5e27a40f74ce58cd15f43430d5ebd15d968588d491dee17bb31b3f7c19ed7d55e2882a25d30eb
SSDEEP

3072:kOW9mafKzoz3g8gzRnvplYSc5mzozEzoz6zozn:5ykyuykyn

Score

8^/10

evasion

Malware Config

Signatures

Stops running service(s) 3 TTPs
evasion

Modify Existing Service
T1031

Impair Defenses
T1562

Service Stop
T1489
Deletes itself 1 IoCs

Processes:

cmd.exe

pid process

1472 cmd.exe
Drops file in Windows directory 1 IoCs

Processes:

cmd.exe

description ioc process

File opened for modification C:\Windows\Prefetch\READYB~1\READYB~1.ETL cmd.exe
Launches sc.exe 1 IoCs
Sc.exe is a Windows utlilty to control services on the system.

Processes:

sc.exe

pid process

1284 sc.exe

pid	process
1472	cmd.exe

description	ioc	process
File opened for modification	C:\Windows\Prefetch\READYB~1\READYB~1.ETL	cmd.exe

pid	process
1284	sc.exe

Kills process with taskkill 40 IoCs

evasion

Processes:

taskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exe

pid	process
1600	taskkill.exe
896	taskkill.exe
1144	taskkill.exe
556	taskkill.exe
1164	taskkill.exe
1484	taskkill.exe
360	taskkill.exe
1144	taskkill.exe
1240	taskkill.exe
360	taskkill.exe
1556	taskkill.exe
1884	taskkill.exe
2036	taskkill.exe
1332	taskkill.exe
896	taskkill.exe
1884	taskkill.exe
1284	taskkill.exe
1048	taskkill.exe
1720	taskkill.exe
1240	taskkill.exe
1772	taskkill.exe
1928	taskkill.exe
1432	taskkill.exe
988	taskkill.exe
988	taskkill.exe
748	taskkill.exe
1160	taskkill.exe
1628	taskkill.exe
1628	taskkill.exe
1576	taskkill.exe
1432	taskkill.exe
1648	taskkill.exe
1572	taskkill.exe
1900	taskkill.exe
1972	taskkill.exe
1868	taskkill.exe
1928	taskkill.exe
748	taskkill.exe
520	taskkill.exe
1900	taskkill.exe

Modifies registry key 1 TTPs 4 IoCs

Modify Registry
T1112

Processes:

reg.exereg.exereg.exereg.exe

pid process

268 reg.exe
556 reg.exe
984 reg.exe
1392 reg.exe

pid	process
268	reg.exe
556	reg.exe
984	reg.exe
1392	reg.exe

Suspicious use of AdjustPrivilegeToken 40 IoCs

Processes:

description	pid	process
Token: SeDebugPrivilege	2036	taskkill.exe
Token: SeDebugPrivilege	1972	taskkill.exe
Token: SeDebugPrivilege	520	taskkill.exe
Token: SeDebugPrivilege	1160	taskkill.exe
Token: SeDebugPrivilege	1868	taskkill.exe
Token: SeDebugPrivilege	1772	taskkill.exe
Token: SeDebugPrivilege	1332	taskkill.exe
Token: SeDebugPrivilege	1628	taskkill.exe
Token: SeDebugPrivilege	1240	taskkill.exe
Token: SeDebugPrivilege	1576	taskkill.exe
Token: SeDebugPrivilege	1432	taskkill.exe
Token: SeDebugPrivilege	988	taskkill.exe
Token: SeDebugPrivilege	1900	taskkill.exe
Token: SeDebugPrivilege	360	taskkill.exe
Token: SeDebugPrivilege	1928	taskkill.exe
Token: SeDebugPrivilege	896	taskkill.exe
Token: SeDebugPrivilege	1144	taskkill.exe
Token: SeDebugPrivilege	1884	taskkill.exe
Token: SeDebugPrivilege	748	taskkill.exe
Token: SeDebugPrivilege	1284	taskkill.exe
Token: SeDebugPrivilege	556	taskkill.exe
Token: SeDebugPrivilege	1164	taskkill.exe
Token: SeDebugPrivilege	1048	taskkill.exe
Token: SeDebugPrivilege	1720	taskkill.exe
Token: SeDebugPrivilege	1648	taskkill.exe
Token: SeDebugPrivilege	1484	taskkill.exe
Token: SeDebugPrivilege	1600	taskkill.exe
Token: SeDebugPrivilege	1572	taskkill.exe
Token: SeDebugPrivilege	1628	taskkill.exe
Token: SeDebugPrivilege	1240	taskkill.exe
Token: SeDebugPrivilege	1556	taskkill.exe
Token: SeDebugPrivilege	1432	taskkill.exe
Token: SeDebugPrivilege	988	taskkill.exe
Token: SeDebugPrivilege	1900	taskkill.exe
Token: SeDebugPrivilege	360	taskkill.exe
Token: SeDebugPrivilege	1928	taskkill.exe
Token: SeDebugPrivilege	896	taskkill.exe
Token: SeDebugPrivilege	1144	taskkill.exe
Token: SeDebugPrivilege	1884	taskkill.exe
Token: SeDebugPrivilege	748	taskkill.exe

Suspicious use of WriteProcessMemory 64 IoCs

Processes:

cmd.exe

description	pid	process	target process
PID 1472 wrote to memory of 2036	1472	cmd.exe	taskkill.exe
PID 1472 wrote to memory of 2036	1472	cmd.exe	taskkill.exe
PID 1472 wrote to memory of 2036	1472	cmd.exe	taskkill.exe
PID 1472 wrote to memory of 1972	1472	cmd.exe	taskkill.exe
PID 1472 wrote to memory of 1972	1472	cmd.exe	taskkill.exe
PID 1472 wrote to memory of 1972	1472	cmd.exe	taskkill.exe
PID 1472 wrote to memory of 520	1472	cmd.exe	taskkill.exe
PID 1472 wrote to memory of 520	1472	cmd.exe	taskkill.exe
PID 1472 wrote to memory of 520	1472	cmd.exe	taskkill.exe
PID 1472 wrote to memory of 1160	1472	cmd.exe	taskkill.exe
PID 1472 wrote to memory of 1160	1472	cmd.exe	taskkill.exe
PID 1472 wrote to memory of 1160	1472	cmd.exe	taskkill.exe
PID 1472 wrote to memory of 1868	1472	cmd.exe	taskkill.exe
PID 1472 wrote to memory of 1868	1472	cmd.exe	taskkill.exe
PID 1472 wrote to memory of 1868	1472	cmd.exe	taskkill.exe
PID 1472 wrote to memory of 1772	1472	cmd.exe	taskkill.exe
PID 1472 wrote to memory of 1772	1472	cmd.exe	taskkill.exe
PID 1472 wrote to memory of 1772	1472	cmd.exe	taskkill.exe
PID 1472 wrote to memory of 1332	1472	cmd.exe	taskkill.exe
PID 1472 wrote to memory of 1332	1472	cmd.exe	taskkill.exe
PID 1472 wrote to memory of 1332	1472	cmd.exe	taskkill.exe
PID 1472 wrote to memory of 1628	1472	cmd.exe	taskkill.exe
PID 1472 wrote to memory of 1628	1472	cmd.exe	taskkill.exe
PID 1472 wrote to memory of 1628	1472	cmd.exe	taskkill.exe
PID 1472 wrote to memory of 1240	1472	cmd.exe	taskkill.exe
PID 1472 wrote to memory of 1240	1472	cmd.exe	taskkill.exe
PID 1472 wrote to memory of 1240	1472	cmd.exe	taskkill.exe
PID 1472 wrote to memory of 1576	1472	cmd.exe	taskkill.exe
PID 1472 wrote to memory of 1576	1472	cmd.exe	taskkill.exe
PID 1472 wrote to memory of 1576	1472	cmd.exe	taskkill.exe
PID 1472 wrote to memory of 1432	1472	cmd.exe	taskkill.exe
PID 1472 wrote to memory of 1432	1472	cmd.exe	taskkill.exe
PID 1472 wrote to memory of 1432	1472	cmd.exe	taskkill.exe
PID 1472 wrote to memory of 988	1472	cmd.exe	taskkill.exe
PID 1472 wrote to memory of 988	1472	cmd.exe	taskkill.exe
PID 1472 wrote to memory of 988	1472	cmd.exe	taskkill.exe
PID 1472 wrote to memory of 1900	1472	cmd.exe	taskkill.exe
PID 1472 wrote to memory of 1900	1472	cmd.exe	taskkill.exe
PID 1472 wrote to memory of 1900	1472	cmd.exe	taskkill.exe
PID 1472 wrote to memory of 360	1472	cmd.exe	taskkill.exe
PID 1472 wrote to memory of 360	1472	cmd.exe	taskkill.exe
PID 1472 wrote to memory of 360	1472	cmd.exe	taskkill.exe
PID 1472 wrote to memory of 1928	1472	cmd.exe	taskkill.exe
PID 1472 wrote to memory of 1928	1472	cmd.exe	taskkill.exe
PID 1472 wrote to memory of 1928	1472	cmd.exe	taskkill.exe
PID 1472 wrote to memory of 896	1472	cmd.exe	taskkill.exe
PID 1472 wrote to memory of 896	1472	cmd.exe	taskkill.exe
PID 1472 wrote to memory of 896	1472	cmd.exe	taskkill.exe
PID 1472 wrote to memory of 1144	1472	cmd.exe	taskkill.exe
PID 1472 wrote to memory of 1144	1472	cmd.exe	taskkill.exe
PID 1472 wrote to memory of 1144	1472	cmd.exe	taskkill.exe
PID 1472 wrote to memory of 1884	1472	cmd.exe	taskkill.exe
PID 1472 wrote to memory of 1884	1472	cmd.exe	taskkill.exe
PID 1472 wrote to memory of 1884	1472	cmd.exe	taskkill.exe
PID 1472 wrote to memory of 748	1472	cmd.exe	taskkill.exe
PID 1472 wrote to memory of 748	1472	cmd.exe	taskkill.exe
PID 1472 wrote to memory of 748	1472	cmd.exe	taskkill.exe
PID 1472 wrote to memory of 1284	1472	cmd.exe	taskkill.exe
PID 1472 wrote to memory of 1284	1472	cmd.exe	taskkill.exe
PID 1472 wrote to memory of 1284	1472	cmd.exe	taskkill.exe
PID 1472 wrote to memory of 556	1472	cmd.exe	taskkill.exe
PID 1472 wrote to memory of 556	1472	cmd.exe	taskkill.exe
PID 1472 wrote to memory of 556	1472	cmd.exe	taskkill.exe
PID 1472 wrote to memory of 1164	1472	cmd.exe	taskkill.exe

C:\Windows\system32\cmd.exe
cmd /c "C:\Users\Admin\AppData\Local\Temp\Meta Unban\Cleaners\full deep cleaner by nigga mhatt lol.bat"
1⤵
- Deletes itself
- Drops file in Windows directory
- Suspicious use of WriteProcessMemory
PID:1472

C:\Windows\system32\taskkill.exe
taskkill /f /im epicgameslauncher.exe
2⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:2036

C:\Windows\system32\taskkill.exe
taskkill /f /im FortniteClient-Win64-Shipping_EAC.exe
2⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:1972

C:\Windows\system32\taskkill.exe
taskkill /f /im FortniteClient-Win64-Shipping.exe
2⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:520

C:\Windows\system32\taskkill.exe
taskkill /f /im FortniteClient-Win64-Shipping_BE.exe
2⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:1160

C:\Windows\system32\taskkill.exe
taskkill /f /im FortniteLauncher.exe
2⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:1868

C:\Windows\system32\taskkill.exe
taskkill /f /im UnrealCEFSubProcess.exe
2⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:1772

C:\Windows\system32\taskkill.exe
taskkill /f /im CEFProcess.exe
2⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:1332

C:\Windows\system32\taskkill.exe
taskkill /f /im EasyAntiCheat.exe
2⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:1628

C:\Windows\system32\taskkill.exe
taskkill /f /im BEService.exe
2⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:1240

C:\Windows\system32\taskkill.exe
taskkill /f /im BEServices.exe
2⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:1576

C:\Windows\system32\taskkill.exe
taskkill /f /im BattleEye.exe
2⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:1432

C:\Windows\system32\taskkill.exe
taskkill /f /im smartscreen.exe
2⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:988

C:\Windows\system32\taskkill.exe
taskkill /f /im smartscreen.exe
2⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:1900

C:\Windows\system32\taskkill.exe
taskkill /f /im EasyAntiCheat.exe
2⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:360

C:\Windows\system32\taskkill.exe
taskkill /f /im dnf.exe
2⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:1928

C:\Windows\system32\taskkill.exe
taskkill /f /im DNF.exe
2⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:896

C:\Windows\system32\taskkill.exe
taskkill /f /im CrossProxy.exe
2⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:1144

C:\Windows\system32\taskkill.exe
taskkill /f /im tensafe_1.exe
2⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:1884

C:\Windows\system32\taskkill.exe
taskkill /f /im TenSafe_1.exe
2⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:748

C:\Windows\system32\taskkill.exe
taskkill /f /im tensafe_2.exe
2⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:1284

C:\Windows\system32\taskkill.exe
taskkill /f /im tencentdl.exe
2⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:556

C:\Windows\system32\taskkill.exe
taskkill /f /im TenioDL.exe
2⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:1164

C:\Windows\system32\taskkill.exe
taskkill /f /im uishell.exe
2⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:1048

C:\Windows\system32\taskkill.exe
taskkill /f /im BackgroundDownloader.exe
2⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:1720

C:\Windows\system32\taskkill.exe
taskkill /f /im conime.exe
2⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:1648

C:\Windows\system32\taskkill.exe
taskkill /f /im QQDL.EXE
2⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:1484

C:\Windows\system32\taskkill.exe
taskkill /f /im qqlogin.exe
2⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:1600

C:\Windows\system32\taskkill.exe
taskkill /f /im dnfchina.exe
2⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:1572

C:\Windows\system32\taskkill.exe
taskkill /f /im dnfchinatest.exe
2⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:1628

C:\Windows\system32\taskkill.exe
taskkill /f /im dnf.exe
2⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:1240

C:\Windows\system32\taskkill.exe
taskkill /f /im txplatform.exe
2⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:1556

C:\Windows\system32\taskkill.exe
taskkill /f /im TXPlatform.exe
2⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:1432

C:\Windows\system32\taskkill.exe
taskkill /f /im OriginWebHelperService.exe
2⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:988

C:\Windows\system32\taskkill.exe
taskkill /f /im Origin.exe
2⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:1900

C:\Windows\system32\taskkill.exe
taskkill /f /im OriginClientService.exe
2⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:360

C:\Windows\system32\taskkill.exe
taskkill /f /im OriginER.exe
2⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:1928

C:\Windows\system32\taskkill.exe
taskkill /f /im OriginThinSetupInternal.exe
2⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:896

C:\Windows\system32\taskkill.exe
taskkill /f /im OriginLegacyCLI.exe
2⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:1144

C:\Windows\system32\taskkill.exe
taskkill /f /im Agent.exe
2⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:1884

C:\Windows\system32\taskkill.exe
taskkill /f /im Client.exe
2⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:748

C:\Windows\system32\sc.exe
Sc stop EasyAntiCheat
2⤵
- Launches sc.exe
PID:1284

C:\Windows\system32\reg.exe
REG ADD HKLM\SYSTEM\CurrentControlSet\Control\IDConfigDB\Hardware" "Profiles\0001 /v HwProfileGuid /t REG_SZ /d {10724-14180-31225-6636} /f
2⤵
- Modifies registry key
PID:268

C:\Windows\system32\reg.exe
REG ADD HKLM\SYSTEM\CurrentControlSet\Control\IDConfigDB\Hardware" "Profiles\0001 /v GUID /t REG_SZ /d {18484-871-28250-19403} /f
2⤵
- Modifies registry key
PID:556

C:\Windows\system32\reg.exe
REG ADD HKLM\SOFTWARE\Microsoft\Cryptography /v GUID /t REG_SZ /d 15560-24919-4809-20485 /f
2⤵
- Modifies registry key
PID:984

C:\Windows\system32\reg.exe
REG ADD HKLM\SOFTWARE\Microsoft\Cryptography /v MachineGuid /t REG_SZ /d 22216-11659-13518-22093 /f
2⤵
- Modifies registry key
PID:1392

C:\Windows\system32\reg.exe
reg delete "HKEY_CURRENT_USER\Software\Epic Games" /f
2⤵
PID:1388

C:\Windows\system32\reg.exe
reg delete "HKEY_LOCAL_MACHINE\SOFTWARE\Classes\com.epicgames.launcher" /f
2⤵
PID:876

C:\Windows\system32\reg.exe
reg delete "HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\EpicGames" /f
2⤵
PID:1160

C:\Windows\system32\reg.exe
reg delete "HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Epic Games" /f
2⤵
PID:584

C:\Windows\system32\reg.exe
reg delete "HKEY_CLASSES_ROOT\com.epicgames.launcher" /f
2⤵
PID:1048

C:\Windows\system32\reg.exe
reg delete "HKEY_LOCAL_MACHINE\Software\Epic Games" /f
2⤵
PID:1868

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Modify Existing Service

T1031

Privilege Escalation

Defense Evasion

Impair Defenses

T1562

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Service Stop

T1489

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads