77e6ae4adb21785c15b5345027e002b880e5ac3488a53567a977cd8f71011d25

Analysis

max time kernel
149s
max time network
30s
platform
windows7_x64
resource
win7-20230220-en
resource tags

arch:x64arch:x86image:win7-20230220-enlocale:en-usos:windows7-x64system
submitted
31-03-2023 20:10

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

install req.bat
Size

44B
MD5

c0bc736bea452911dc1d05b2057f7930
SHA1

f791d45638d871b3363d7d901a1d02e682d984c9
SHA256

75063883cdc9f24f0a5be967af68e302a3c89f0fb8876900e82b70786f2ca854
SHA512

34d46be255a96cb2c6d967d6f50401852085f0634bc7ca4cf96d32e0907146b3c5e67276bd8de00efbeef27ccb31442a04501d50b4fa7d27c8f0ae411e60b805

Score

1^/10

Malware Config

Signatures

Delays execution with timeout.exe 64 IoCs

evasion

Processes:

timeout.exetimeout.exetimeout.exetimeout.exetimeout.exetimeout.exetimeout.exetimeout.exetimeout.exetimeout.exetimeout.exetimeout.exetimeout.exetimeout.exetimeout.exetimeout.exetimeout.exetimeout.exetimeout.exetimeout.exetimeout.exetimeout.exetimeout.exetimeout.exetimeout.exetimeout.exetimeout.exetimeout.exetimeout.exetimeout.exetimeout.exetimeout.exetimeout.exetimeout.exetimeout.exetimeout.exetimeout.exetimeout.exetimeout.exetimeout.exetimeout.exetimeout.exetimeout.exetimeout.exetimeout.exetimeout.exetimeout.exetimeout.exetimeout.exetimeout.exetimeout.exetimeout.exetimeout.exetimeout.exetimeout.exetimeout.exetimeout.exetimeout.exetimeout.exetimeout.exetimeout.exetimeout.exetimeout.exetimeout.exe

pid	process
872	timeout.exe
1636	timeout.exe
2040	timeout.exe
1588	timeout.exe
320	timeout.exe
1372	timeout.exe
1044	timeout.exe
1740	timeout.exe
1604	timeout.exe
1032	timeout.exe
1560	timeout.exe
1164	timeout.exe
1116	timeout.exe
1340	timeout.exe
1980	timeout.exe
1952	timeout.exe
568	timeout.exe
1664	timeout.exe
376	timeout.exe
1620	timeout.exe
904	timeout.exe
1084	timeout.exe
1868	timeout.exe
776	timeout.exe
2012	timeout.exe
828	timeout.exe
828	timeout.exe
1688	timeout.exe
1796	timeout.exe
1808	timeout.exe
1720	timeout.exe
1316	timeout.exe
992	timeout.exe
320	timeout.exe
744	timeout.exe
832	timeout.exe
1540	timeout.exe
548	timeout.exe
1708	timeout.exe
528	timeout.exe
636	timeout.exe
1908	timeout.exe
1356	timeout.exe
1932	timeout.exe
336	timeout.exe
1960	timeout.exe
1168	timeout.exe
916	timeout.exe
1336	timeout.exe
1508	timeout.exe
684	timeout.exe
1552	timeout.exe
1628	timeout.exe
976	timeout.exe
1428	timeout.exe
540	timeout.exe
1948	timeout.exe
1584	timeout.exe
1760	timeout.exe
684	timeout.exe
1964	timeout.exe
1308	timeout.exe
636	timeout.exe
1804	timeout.exe

Kills process with taskkill 1 IoCs
evasion

Processes:

taskkill.exe

pid process

1968 taskkill.exe
Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

taskkill.exe

description pid process

Token: SeDebugPrivilege 1968 taskkill.exe

pid	process
1968	taskkill.exe

description	pid	process
Token: SeDebugPrivilege	1968	taskkill.exe

Suspicious use of WriteProcessMemory 64 IoCs

Processes:

cmd.execmd.exe

description	pid	process	target process
PID 2008 wrote to memory of 1968	2008	cmd.exe	taskkill.exe
PID 2008 wrote to memory of 1968	2008	cmd.exe	taskkill.exe
PID 2008 wrote to memory of 1968	2008	cmd.exe	taskkill.exe
PID 2008 wrote to memory of 680	2008	cmd.exe	cmd.exe
PID 2008 wrote to memory of 680	2008	cmd.exe	cmd.exe
PID 2008 wrote to memory of 680	2008	cmd.exe	cmd.exe
PID 2008 wrote to memory of 320	2008	cmd.exe	timeout.exe
PID 2008 wrote to memory of 320	2008	cmd.exe	timeout.exe
PID 2008 wrote to memory of 320	2008	cmd.exe	timeout.exe
PID 680 wrote to memory of 1492	680	cmd.exe	cmd.exe
PID 680 wrote to memory of 1492	680	cmd.exe	cmd.exe
PID 680 wrote to memory of 1492	680	cmd.exe	cmd.exe
PID 2008 wrote to memory of 744	2008	cmd.exe	timeout.exe
PID 2008 wrote to memory of 744	2008	cmd.exe	timeout.exe
PID 2008 wrote to memory of 744	2008	cmd.exe	timeout.exe
PID 2008 wrote to memory of 376	2008	cmd.exe	timeout.exe
PID 2008 wrote to memory of 376	2008	cmd.exe	timeout.exe
PID 2008 wrote to memory of 376	2008	cmd.exe	timeout.exe
PID 2008 wrote to memory of 1164	2008	cmd.exe	timeout.exe
PID 2008 wrote to memory of 1164	2008	cmd.exe	timeout.exe
PID 2008 wrote to memory of 1164	2008	cmd.exe	timeout.exe
PID 2008 wrote to memory of 1428	2008	cmd.exe	timeout.exe
PID 2008 wrote to memory of 1428	2008	cmd.exe	timeout.exe
PID 2008 wrote to memory of 1428	2008	cmd.exe	timeout.exe
PID 2008 wrote to memory of 1760	2008	cmd.exe	timeout.exe
PID 2008 wrote to memory of 1760	2008	cmd.exe	timeout.exe
PID 2008 wrote to memory of 1760	2008	cmd.exe	timeout.exe
PID 2008 wrote to memory of 1116	2008	cmd.exe	timeout.exe
PID 2008 wrote to memory of 1116	2008	cmd.exe	timeout.exe
PID 2008 wrote to memory of 1116	2008	cmd.exe	timeout.exe
PID 2008 wrote to memory of 1328	2008	cmd.exe	timeout.exe
PID 2008 wrote to memory of 1328	2008	cmd.exe	timeout.exe
PID 2008 wrote to memory of 1328	2008	cmd.exe	timeout.exe
PID 2008 wrote to memory of 1804	2008	cmd.exe	timeout.exe
PID 2008 wrote to memory of 1804	2008	cmd.exe	timeout.exe
PID 2008 wrote to memory of 1804	2008	cmd.exe	timeout.exe
PID 2008 wrote to memory of 636	2008	cmd.exe	timeout.exe
PID 2008 wrote to memory of 636	2008	cmd.exe	timeout.exe
PID 2008 wrote to memory of 636	2008	cmd.exe	timeout.exe
PID 2008 wrote to memory of 828	2008	cmd.exe	timeout.exe
PID 2008 wrote to memory of 828	2008	cmd.exe	timeout.exe
PID 2008 wrote to memory of 828	2008	cmd.exe	timeout.exe
PID 2008 wrote to memory of 684	2008	cmd.exe	timeout.exe
PID 2008 wrote to memory of 684	2008	cmd.exe	timeout.exe
PID 2008 wrote to memory of 684	2008	cmd.exe	timeout.exe
PID 2008 wrote to memory of 872	2008	cmd.exe	timeout.exe
PID 2008 wrote to memory of 872	2008	cmd.exe	timeout.exe
PID 2008 wrote to memory of 872	2008	cmd.exe	timeout.exe
PID 2008 wrote to memory of 868	2008	cmd.exe	timeout.exe
PID 2008 wrote to memory of 868	2008	cmd.exe	timeout.exe
PID 2008 wrote to memory of 868	2008	cmd.exe	timeout.exe
PID 2008 wrote to memory of 1336	2008	cmd.exe	timeout.exe
PID 2008 wrote to memory of 1336	2008	cmd.exe	timeout.exe
PID 2008 wrote to memory of 1336	2008	cmd.exe	timeout.exe
PID 2008 wrote to memory of 1664	2008	cmd.exe	timeout.exe
PID 2008 wrote to memory of 1664	2008	cmd.exe	timeout.exe
PID 2008 wrote to memory of 1664	2008	cmd.exe	timeout.exe
PID 2008 wrote to memory of 1908	2008	cmd.exe	timeout.exe
PID 2008 wrote to memory of 1908	2008	cmd.exe	timeout.exe
PID 2008 wrote to memory of 1908	2008	cmd.exe	timeout.exe
PID 2008 wrote to memory of 1548	2008	cmd.exe	timeout.exe
PID 2008 wrote to memory of 1548	2008	cmd.exe	timeout.exe
PID 2008 wrote to memory of 1548	2008	cmd.exe	timeout.exe
PID 2008 wrote to memory of 540	2008	cmd.exe	timeout.exe

C:\Windows\system32\cmd.exe
cmd /c "C:\Users\Admin\AppData\Local\Temp\install req.bat"
1⤵
- Suspicious use of WriteProcessMemory
PID:2008

C:\Windows\system32\taskkill.exe
taskkill /f /im python.exe
2⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:1968

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /K disclaimer.bat
2⤵
- Suspicious use of WriteProcessMemory
PID:680

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "prompt #$H#$E# & echo on & for %b in (1) do rem"
3⤵
PID:1492

C:\Windows\system32\timeout.exe
timeout /t 1
2⤵
- Delays execution with timeout.exe
PID:320

C:\Windows\system32\timeout.exe
timeout /t 1
2⤵
- Delays execution with timeout.exe
PID:744

C:\Windows\system32\timeout.exe
timeout /t 1
2⤵
- Delays execution with timeout.exe
PID:376

C:\Windows\system32\timeout.exe
timeout /t 1
2⤵
- Delays execution with timeout.exe
PID:1164

C:\Windows\system32\timeout.exe
timeout /t 1
2⤵
- Delays execution with timeout.exe
PID:1428

C:\Windows\system32\timeout.exe
timeout /t 1
2⤵
- Delays execution with timeout.exe
PID:1760

C:\Windows\system32\timeout.exe
timeout /t 1
2⤵
- Delays execution with timeout.exe
PID:1116

C:\Windows\system32\timeout.exe
timeout /t 1
2⤵
PID:1328

C:\Windows\system32\timeout.exe
timeout /t 1
2⤵
- Delays execution with timeout.exe
PID:1804

C:\Windows\system32\timeout.exe
timeout /t 1
2⤵
- Delays execution with timeout.exe
PID:636

C:\Windows\system32\timeout.exe
timeout /t 1
2⤵
- Delays execution with timeout.exe
PID:828

C:\Windows\system32\timeout.exe
timeout /t 1
2⤵
- Delays execution with timeout.exe
PID:684

C:\Windows\system32\timeout.exe
timeout /t 1
2⤵
- Delays execution with timeout.exe
PID:872

C:\Windows\system32\timeout.exe
timeout /t 1
2⤵
PID:868

C:\Windows\system32\timeout.exe
timeout /t 1
2⤵
- Delays execution with timeout.exe
PID:1336

C:\Windows\system32\timeout.exe
timeout /t 1
2⤵
PID:1664

C:\Windows\system32\timeout.exe
timeout /t 1
2⤵
- Delays execution with timeout.exe
PID:1908

C:\Windows\system32\timeout.exe
timeout /t 1
2⤵
PID:1548

C:\Windows\system32\timeout.exe
timeout /t 1
2⤵
- Delays execution with timeout.exe
PID:540

C:\Windows\system32\timeout.exe
timeout /t 1
2⤵
- Delays execution with timeout.exe
PID:1688

C:\Windows\system32\timeout.exe
timeout /t 1
2⤵
- Delays execution with timeout.exe
PID:1356

C:\Windows\system32\timeout.exe
timeout /t 1
2⤵
- Delays execution with timeout.exe
PID:832

C:\Windows\system32\timeout.exe
timeout /t 1
2⤵
- Delays execution with timeout.exe
PID:1372

C:\Windows\system32\timeout.exe
timeout /t 1
2⤵
- Delays execution with timeout.exe
PID:336

C:\Windows\system32\timeout.exe
timeout /t 1
2⤵
PID:1200

C:\Windows\system32\timeout.exe
timeout /t 1
2⤵
PID:588

C:\Windows\system32\timeout.exe
timeout /t 1
2⤵
- Delays execution with timeout.exe
PID:1948

C:\Windows\system32\timeout.exe
timeout /t 1
2⤵
PID:1532

C:\Windows\system32\timeout.exe
timeout /t 1
2⤵
- Delays execution with timeout.exe
PID:1508

C:\Windows\system32\timeout.exe
timeout /t 1
2⤵
- Delays execution with timeout.exe
PID:1796

C:\Windows\system32\timeout.exe
timeout /t 1
2⤵
- Delays execution with timeout.exe
PID:1540

C:\Windows\system32\timeout.exe
timeout /t 1
2⤵
- Delays execution with timeout.exe
PID:1932

C:\Windows\system32\timeout.exe
timeout /t 1
2⤵
- Delays execution with timeout.exe
PID:1808

C:\Windows\system32\timeout.exe
timeout /t 1
2⤵
- Delays execution with timeout.exe
PID:1620

C:\Windows\system32\timeout.exe
timeout /t 1
2⤵
PID:1332

C:\Windows\system32\timeout.exe
timeout /t 1
2⤵
- Delays execution with timeout.exe
PID:1340

C:\Windows\system32\timeout.exe
timeout /t 1
2⤵
- Delays execution with timeout.exe
PID:1720

C:\Windows\system32\timeout.exe
timeout /t 1
2⤵
PID:1616

C:\Windows\system32\timeout.exe
timeout /t 1
2⤵
- Delays execution with timeout.exe
PID:1868

C:\Windows\system32\timeout.exe
timeout /t 1
2⤵
- Delays execution with timeout.exe
PID:1044

C:\Windows\system32\timeout.exe
timeout /t 1
2⤵
- Delays execution with timeout.exe
PID:776

C:\Windows\system32\timeout.exe
timeout /t 1
2⤵
- Delays execution with timeout.exe
PID:904

C:\Windows\system32\timeout.exe
timeout /t 1
2⤵
- Delays execution with timeout.exe
PID:1084

C:\Windows\system32\timeout.exe
timeout /t 1
2⤵
- Delays execution with timeout.exe
PID:1316

C:\Windows\system32\timeout.exe
timeout /t 1
2⤵
- Delays execution with timeout.exe
PID:1740

C:\Windows\system32\timeout.exe
timeout /t 1
2⤵
- Delays execution with timeout.exe
PID:1980

C:\Windows\system32\timeout.exe
timeout /t 1
2⤵
PID:1188

C:\Windows\system32\timeout.exe
timeout /t 1
2⤵
- Delays execution with timeout.exe
PID:1032

C:\Windows\system32\timeout.exe
timeout /t 1
2⤵
PID:1272

C:\Windows\system32\timeout.exe
timeout /t 1
2⤵
PID:1892

C:\Windows\system32\timeout.exe
timeout /t 1
2⤵
- Delays execution with timeout.exe
PID:548

C:\Windows\system32\timeout.exe
timeout /t 1
2⤵
- Delays execution with timeout.exe
PID:1708

C:\Windows\system32\timeout.exe
timeout /t 1
2⤵
- Delays execution with timeout.exe
PID:1636

C:\Windows\system32\timeout.exe
timeout /t 1
2⤵
- Delays execution with timeout.exe
PID:1952

C:\Windows\system32\timeout.exe
timeout /t 1
2⤵
- Delays execution with timeout.exe
PID:1960

C:\Windows\system32\timeout.exe
timeout /t 1
2⤵
- Delays execution with timeout.exe
PID:568

C:\Windows\system32\timeout.exe
timeout /t 1
2⤵
PID:1492

C:\Windows\system32\timeout.exe
timeout /t 1
2⤵
- Delays execution with timeout.exe
PID:1584

C:\Windows\system32\timeout.exe
timeout /t 1
2⤵
PID:1716

C:\Windows\system32\timeout.exe
timeout /t 1
2⤵
- Delays execution with timeout.exe
PID:1964

C:\Windows\system32\timeout.exe
timeout /t 1
2⤵
- Delays execution with timeout.exe
PID:1604

C:\Windows\system32\timeout.exe
timeout /t 1
2⤵
- Delays execution with timeout.exe
PID:2012

C:\Windows\system32\timeout.exe
timeout /t 1
2⤵
- Delays execution with timeout.exe
PID:320

C:\Windows\system32\timeout.exe
timeout /t 1
2⤵
PID:744

C:\Windows\system32\timeout.exe
timeout /t 1
2⤵
- Delays execution with timeout.exe
PID:2040

C:\Windows\system32\timeout.exe
timeout /t 1
2⤵
- Delays execution with timeout.exe
PID:1168

C:\Windows\system32\timeout.exe
timeout /t 1
2⤵
- Delays execution with timeout.exe
PID:528

C:\Windows\system32\timeout.exe
timeout /t 1
2⤵
PID:1212

C:\Windows\system32\timeout.exe
timeout /t 1
2⤵
- Delays execution with timeout.exe
PID:916

C:\Windows\system32\timeout.exe
timeout /t 1
2⤵
PID:1012

C:\Windows\system32\timeout.exe
timeout /t 1
2⤵
PID:1328

C:\Windows\system32\timeout.exe
timeout /t 1
2⤵
PID:1804

C:\Windows\system32\timeout.exe
timeout /t 1
2⤵
- Delays execution with timeout.exe
PID:636

C:\Windows\system32\timeout.exe
timeout /t 1
2⤵
- Delays execution with timeout.exe
PID:828

C:\Windows\system32\timeout.exe
timeout /t 1
2⤵
- Delays execution with timeout.exe
PID:684

C:\Windows\system32\timeout.exe
timeout /t 1
2⤵
PID:1288

C:\Windows\system32\timeout.exe
timeout /t 1
2⤵
- Delays execution with timeout.exe
PID:1308

C:\Windows\system32\timeout.exe
timeout /t 1
2⤵
- Delays execution with timeout.exe
PID:1552

C:\Windows\system32\timeout.exe
timeout /t 1
2⤵
- Delays execution with timeout.exe
PID:992

C:\Windows\system32\timeout.exe
timeout /t 1
2⤵
- Delays execution with timeout.exe
PID:1664

C:\Windows\system32\timeout.exe
timeout /t 1
2⤵
- Delays execution with timeout.exe
PID:1560

C:\Windows\system32\timeout.exe
timeout /t 1
2⤵
- Delays execution with timeout.exe
PID:1628

C:\Windows\system32\timeout.exe
timeout /t 1
2⤵
- Delays execution with timeout.exe
PID:1588

C:\Windows\system32\timeout.exe
timeout /t 1
2⤵
- Delays execution with timeout.exe
PID:976

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads