Overview
overview
8Static
static
1disclaimer.bat
windows7-x64
1disclaimer.bat
windows10-2004-x64
1install req.bat
windows7-x64
1install req.bat
windows10-2004-x64
1main.py
windows7-x64
3main.py
windows10-2004-x64
3setup.bat
windows7-x64
1setup.bat
windows10-2004-x64
1start.bat
windows7-x64
1start.bat
windows10-2004-x64
1web/gui.html
windows7-x64
1web/gui.html
windows10-2004-x64
8web/index.js
windows7-x64
1web/index.js
windows10-2004-x64
1Analysis
-
max time kernel
150s -
max time network
147s -
platform
windows10-2004_x64 -
resource
win10v2004-20230220-en -
resource tags
arch:x64arch:x86image:win10v2004-20230220-enlocale:en-usos:windows10-2004-x64system -
submitted
31-03-2023 20:10
Static task
static1
Behavioral task
behavioral1
Sample
disclaimer.bat
Resource
win7-20230220-en
Behavioral task
behavioral2
Sample
disclaimer.bat
Resource
win10v2004-20230220-en
Behavioral task
behavioral3
Sample
install req.bat
Resource
win7-20230220-en
Behavioral task
behavioral4
Sample
install req.bat
Resource
win10v2004-20230220-en
Behavioral task
behavioral5
Sample
main.py
Resource
win7-20230220-en
Behavioral task
behavioral6
Sample
main.py
Resource
win10v2004-20230220-en
Behavioral task
behavioral7
Sample
setup.bat
Resource
win7-20230220-en
Behavioral task
behavioral8
Sample
setup.bat
Resource
win10v2004-20230221-en
Behavioral task
behavioral9
Sample
start.bat
Resource
win7-20230220-en
Behavioral task
behavioral10
Sample
start.bat
Resource
win10v2004-20230220-en
Behavioral task
behavioral11
Sample
web/gui.html
Resource
win7-20230220-en
Behavioral task
behavioral12
Sample
web/gui.html
Resource
win10v2004-20230220-en
Behavioral task
behavioral13
Sample
web/index.js
Resource
win7-20230220-en
Behavioral task
behavioral14
Sample
web/index.js
Resource
win10v2004-20230220-en
General
-
Target
install req.bat
-
Size
44B
-
MD5
c0bc736bea452911dc1d05b2057f7930
-
SHA1
f791d45638d871b3363d7d901a1d02e682d984c9
-
SHA256
75063883cdc9f24f0a5be967af68e302a3c89f0fb8876900e82b70786f2ca854
-
SHA512
34d46be255a96cb2c6d967d6f50401852085f0634bc7ca4cf96d32e0907146b3c5e67276bd8de00efbeef27ccb31442a04501d50b4fa7d27c8f0ae411e60b805
Malware Config
Signatures
-
Delays execution with timeout.exe 64 IoCs
Processes:
timeout.exetimeout.exetimeout.exetimeout.exetimeout.exetimeout.exetimeout.exetimeout.exetimeout.exetimeout.exetimeout.exetimeout.exetimeout.exetimeout.exetimeout.exetimeout.exetimeout.exetimeout.exetimeout.exetimeout.exetimeout.exetimeout.exetimeout.exetimeout.exetimeout.exetimeout.exetimeout.exetimeout.exetimeout.exetimeout.exetimeout.exetimeout.exetimeout.exetimeout.exetimeout.exetimeout.exetimeout.exetimeout.exetimeout.exetimeout.exetimeout.exetimeout.exetimeout.exetimeout.exetimeout.exetimeout.exetimeout.exetimeout.exetimeout.exetimeout.exetimeout.exetimeout.exetimeout.exetimeout.exetimeout.exetimeout.exetimeout.exetimeout.exetimeout.exetimeout.exetimeout.exetimeout.exetimeout.exetimeout.exepid process 4912 timeout.exe 2724 timeout.exe 3296 timeout.exe 1992 timeout.exe 1676 timeout.exe 1948 timeout.exe 2232 timeout.exe 3976 timeout.exe 4748 timeout.exe 1320 timeout.exe 4432 timeout.exe 2804 timeout.exe 1056 timeout.exe 4440 timeout.exe 4700 timeout.exe 3824 timeout.exe 2252 timeout.exe 4552 timeout.exe 4764 timeout.exe 4372 timeout.exe 896 timeout.exe 4188 timeout.exe 3188 timeout.exe 3244 timeout.exe 1468 timeout.exe 3120 timeout.exe 4628 timeout.exe 1036 timeout.exe 636 timeout.exe 3364 timeout.exe 3328 timeout.exe 4980 timeout.exe 3684 timeout.exe 4192 timeout.exe 208 timeout.exe 4124 timeout.exe 700 timeout.exe 2184 timeout.exe 3736 timeout.exe 2368 timeout.exe 4468 timeout.exe 548 timeout.exe 3840 timeout.exe 3696 timeout.exe 2480 timeout.exe 3872 timeout.exe 1548 timeout.exe 2284 timeout.exe 1492 timeout.exe 3220 timeout.exe 4536 timeout.exe 2788 timeout.exe 5084 timeout.exe 2608 timeout.exe 3372 timeout.exe 2168 timeout.exe 4776 timeout.exe 4320 timeout.exe 3708 timeout.exe 1704 timeout.exe 460 timeout.exe 4200 timeout.exe 220 timeout.exe 3232 timeout.exe -
Kills process with taskkill 1 IoCs
Processes:
taskkill.exepid process 4248 taskkill.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes:
taskkill.exedescription pid process Token: SeDebugPrivilege 4248 taskkill.exe -
Suspicious use of WriteProcessMemory 64 IoCs
Processes:
cmd.execmd.exedescription pid process target process PID 932 wrote to memory of 4248 932 cmd.exe taskkill.exe PID 932 wrote to memory of 4248 932 cmd.exe taskkill.exe PID 932 wrote to memory of 4020 932 cmd.exe cmd.exe PID 932 wrote to memory of 4020 932 cmd.exe cmd.exe PID 932 wrote to memory of 4628 932 cmd.exe timeout.exe PID 932 wrote to memory of 4628 932 cmd.exe timeout.exe PID 4020 wrote to memory of 4908 4020 cmd.exe cmd.exe PID 4020 wrote to memory of 4908 4020 cmd.exe cmd.exe PID 932 wrote to memory of 4244 932 cmd.exe timeout.exe PID 932 wrote to memory of 4244 932 cmd.exe timeout.exe PID 932 wrote to memory of 4536 932 cmd.exe timeout.exe PID 932 wrote to memory of 4536 932 cmd.exe timeout.exe PID 932 wrote to memory of 1472 932 cmd.exe timeout.exe PID 932 wrote to memory of 1472 932 cmd.exe timeout.exe PID 932 wrote to memory of 2804 932 cmd.exe timeout.exe PID 932 wrote to memory of 2804 932 cmd.exe timeout.exe PID 932 wrote to memory of 4648 932 cmd.exe timeout.exe PID 932 wrote to memory of 4648 932 cmd.exe timeout.exe PID 932 wrote to memory of 3976 932 cmd.exe timeout.exe PID 932 wrote to memory of 3976 932 cmd.exe timeout.exe PID 932 wrote to memory of 2488 932 cmd.exe timeout.exe PID 932 wrote to memory of 2488 932 cmd.exe timeout.exe PID 932 wrote to memory of 5096 932 cmd.exe timeout.exe PID 932 wrote to memory of 5096 932 cmd.exe timeout.exe PID 932 wrote to memory of 220 932 cmd.exe timeout.exe PID 932 wrote to memory of 220 932 cmd.exe timeout.exe PID 932 wrote to memory of 3244 932 cmd.exe timeout.exe PID 932 wrote to memory of 3244 932 cmd.exe timeout.exe PID 932 wrote to memory of 4764 932 cmd.exe timeout.exe PID 932 wrote to memory of 4764 932 cmd.exe timeout.exe PID 932 wrote to memory of 4000 932 cmd.exe timeout.exe PID 932 wrote to memory of 4000 932 cmd.exe timeout.exe PID 932 wrote to memory of 4504 932 cmd.exe timeout.exe PID 932 wrote to memory of 4504 932 cmd.exe timeout.exe PID 932 wrote to memory of 4456 932 cmd.exe timeout.exe PID 932 wrote to memory of 4456 932 cmd.exe timeout.exe PID 932 wrote to memory of 3588 932 cmd.exe timeout.exe PID 932 wrote to memory of 3588 932 cmd.exe timeout.exe PID 932 wrote to memory of 4468 932 cmd.exe timeout.exe PID 932 wrote to memory of 4468 932 cmd.exe timeout.exe PID 932 wrote to memory of 4980 932 cmd.exe timeout.exe PID 932 wrote to memory of 4980 932 cmd.exe timeout.exe PID 932 wrote to memory of 3044 932 cmd.exe timeout.exe PID 932 wrote to memory of 3044 932 cmd.exe timeout.exe PID 932 wrote to memory of 3632 932 cmd.exe timeout.exe PID 932 wrote to memory of 3632 932 cmd.exe timeout.exe PID 932 wrote to memory of 4508 932 cmd.exe timeout.exe PID 932 wrote to memory of 4508 932 cmd.exe timeout.exe PID 932 wrote to memory of 4524 932 cmd.exe timeout.exe PID 932 wrote to memory of 4524 932 cmd.exe timeout.exe PID 932 wrote to memory of 3728 932 cmd.exe timeout.exe PID 932 wrote to memory of 3728 932 cmd.exe timeout.exe PID 932 wrote to memory of 1056 932 cmd.exe timeout.exe PID 932 wrote to memory of 1056 932 cmd.exe timeout.exe PID 932 wrote to memory of 4180 932 cmd.exe timeout.exe PID 932 wrote to memory of 4180 932 cmd.exe timeout.exe PID 932 wrote to memory of 700 932 cmd.exe timeout.exe PID 932 wrote to memory of 700 932 cmd.exe timeout.exe PID 932 wrote to memory of 2232 932 cmd.exe timeout.exe PID 932 wrote to memory of 2232 932 cmd.exe timeout.exe PID 932 wrote to memory of 2184 932 cmd.exe timeout.exe PID 932 wrote to memory of 2184 932 cmd.exe timeout.exe PID 932 wrote to memory of 3608 932 cmd.exe timeout.exe PID 932 wrote to memory of 3608 932 cmd.exe timeout.exe
Processes
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\install req.bat"1⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\taskkill.exetaskkill /f /im python.exe2⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /K disclaimer.bat2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "prompt #$H#$E# & echo on & for %b in (1) do rem"3⤵
-
C:\Windows\system32\timeout.exetimeout /t 12⤵
-
C:\Windows\system32\timeout.exetimeout /t 12⤵
-
C:\Windows\system32\timeout.exetimeout /t 12⤵
- Delays execution with timeout.exe
-
C:\Windows\system32\timeout.exetimeout /t 12⤵
-
C:\Windows\system32\timeout.exetimeout /t 12⤵
- Delays execution with timeout.exe
-
C:\Windows\system32\timeout.exetimeout /t 12⤵
-
C:\Windows\system32\timeout.exetimeout /t 12⤵
- Delays execution with timeout.exe
-
C:\Windows\system32\timeout.exetimeout /t 12⤵
-
C:\Windows\system32\timeout.exetimeout /t 12⤵
-
C:\Windows\system32\timeout.exetimeout /t 12⤵
- Delays execution with timeout.exe
-
C:\Windows\system32\timeout.exetimeout /t 12⤵
- Delays execution with timeout.exe
-
C:\Windows\system32\timeout.exetimeout /t 12⤵
- Delays execution with timeout.exe
-
C:\Windows\system32\timeout.exetimeout /t 12⤵
-
C:\Windows\system32\timeout.exetimeout /t 12⤵
-
C:\Windows\system32\timeout.exetimeout /t 12⤵
-
C:\Windows\system32\timeout.exetimeout /t 12⤵
-
C:\Windows\system32\timeout.exetimeout /t 12⤵
- Delays execution with timeout.exe
-
C:\Windows\system32\timeout.exetimeout /t 12⤵
- Delays execution with timeout.exe
-
C:\Windows\system32\timeout.exetimeout /t 12⤵
-
C:\Windows\system32\timeout.exetimeout /t 12⤵
-
C:\Windows\system32\timeout.exetimeout /t 12⤵
-
C:\Windows\system32\timeout.exetimeout /t 12⤵
-
C:\Windows\system32\timeout.exetimeout /t 12⤵
-
C:\Windows\system32\timeout.exetimeout /t 12⤵
- Delays execution with timeout.exe
-
C:\Windows\system32\timeout.exetimeout /t 12⤵
-
C:\Windows\system32\timeout.exetimeout /t 12⤵
- Delays execution with timeout.exe
-
C:\Windows\system32\timeout.exetimeout /t 12⤵
- Delays execution with timeout.exe
-
C:\Windows\system32\timeout.exetimeout /t 12⤵
- Delays execution with timeout.exe
-
C:\Windows\system32\timeout.exetimeout /t 12⤵
-
C:\Windows\system32\timeout.exetimeout /t 12⤵
-
C:\Windows\system32\timeout.exetimeout /t 12⤵
- Delays execution with timeout.exe
-
C:\Windows\system32\timeout.exetimeout /t 12⤵
- Delays execution with timeout.exe
-
C:\Windows\system32\timeout.exetimeout /t 12⤵
- Delays execution with timeout.exe
-
C:\Windows\system32\timeout.exetimeout /t 12⤵
-
C:\Windows\system32\timeout.exetimeout /t 12⤵
- Delays execution with timeout.exe
-
C:\Windows\system32\timeout.exetimeout /t 12⤵
- Delays execution with timeout.exe
-
C:\Windows\system32\timeout.exetimeout /t 12⤵
- Delays execution with timeout.exe
-
C:\Windows\system32\timeout.exetimeout /t 12⤵
-
C:\Windows\system32\timeout.exetimeout /t 12⤵
- Delays execution with timeout.exe
-
C:\Windows\system32\timeout.exetimeout /t 12⤵
- Delays execution with timeout.exe
-
C:\Windows\system32\timeout.exetimeout /t 12⤵
- Delays execution with timeout.exe
-
C:\Windows\system32\timeout.exetimeout /t 12⤵
-
C:\Windows\system32\timeout.exetimeout /t 12⤵
- Delays execution with timeout.exe
-
C:\Windows\system32\timeout.exetimeout /t 12⤵
- Delays execution with timeout.exe
-
C:\Windows\system32\timeout.exetimeout /t 12⤵
-
C:\Windows\system32\timeout.exetimeout /t 12⤵
- Delays execution with timeout.exe
-
C:\Windows\system32\timeout.exetimeout /t 12⤵
-
C:\Windows\system32\timeout.exetimeout /t 12⤵
- Delays execution with timeout.exe
-
C:\Windows\system32\timeout.exetimeout /t 12⤵
- Delays execution with timeout.exe
-
C:\Windows\system32\timeout.exetimeout /t 12⤵
- Delays execution with timeout.exe
-
C:\Windows\system32\timeout.exetimeout /t 12⤵
-
C:\Windows\system32\timeout.exetimeout /t 12⤵
- Delays execution with timeout.exe
-
C:\Windows\system32\timeout.exetimeout /t 12⤵
- Delays execution with timeout.exe
-
C:\Windows\system32\timeout.exetimeout /t 12⤵
- Delays execution with timeout.exe
-
C:\Windows\system32\timeout.exetimeout /t 12⤵
-
C:\Windows\system32\timeout.exetimeout /t 12⤵
-
C:\Windows\system32\timeout.exetimeout /t 12⤵
- Delays execution with timeout.exe
-
C:\Windows\system32\timeout.exetimeout /t 12⤵
-
C:\Windows\system32\timeout.exetimeout /t 12⤵
- Delays execution with timeout.exe
-
C:\Windows\system32\timeout.exetimeout /t 12⤵
-
C:\Windows\system32\timeout.exetimeout /t 12⤵
-
C:\Windows\system32\timeout.exetimeout /t 12⤵
-
C:\Windows\system32\timeout.exetimeout /t 12⤵
-
C:\Windows\system32\timeout.exetimeout /t 12⤵
- Delays execution with timeout.exe
-
C:\Windows\system32\timeout.exetimeout /t 12⤵
- Delays execution with timeout.exe
-
C:\Windows\system32\timeout.exetimeout /t 12⤵
-
C:\Windows\system32\timeout.exetimeout /t 12⤵
-
C:\Windows\system32\timeout.exetimeout /t 12⤵
-
C:\Windows\system32\timeout.exetimeout /t 12⤵
- Delays execution with timeout.exe
-
C:\Windows\system32\timeout.exetimeout /t 12⤵
- Delays execution with timeout.exe
-
C:\Windows\system32\timeout.exetimeout /t 12⤵
- Delays execution with timeout.exe
-
C:\Windows\system32\timeout.exetimeout /t 12⤵
- Delays execution with timeout.exe
-
C:\Windows\system32\timeout.exetimeout /t 12⤵
-
C:\Windows\system32\timeout.exetimeout /t 12⤵
- Delays execution with timeout.exe
-
C:\Windows\system32\timeout.exetimeout /t 12⤵
- Delays execution with timeout.exe
-
C:\Windows\system32\timeout.exetimeout /t 12⤵
-
C:\Windows\system32\timeout.exetimeout /t 12⤵
-
C:\Windows\system32\timeout.exetimeout /t 12⤵
-
C:\Windows\system32\timeout.exetimeout /t 12⤵
-
C:\Windows\system32\timeout.exetimeout /t 12⤵
-
C:\Windows\system32\timeout.exetimeout /t 12⤵
- Delays execution with timeout.exe
-
C:\Windows\system32\timeout.exetimeout /t 12⤵
-
C:\Windows\system32\timeout.exetimeout /t 12⤵
- Delays execution with timeout.exe
-
C:\Windows\system32\timeout.exetimeout /t 12⤵
-
C:\Windows\system32\timeout.exetimeout /t 12⤵
- Delays execution with timeout.exe
-
C:\Windows\system32\timeout.exetimeout /t 12⤵
-
C:\Windows\system32\timeout.exetimeout /t 12⤵
-
C:\Windows\system32\timeout.exetimeout /t 12⤵
-
C:\Windows\system32\timeout.exetimeout /t 12⤵
-
C:\Windows\system32\timeout.exetimeout /t 12⤵
-
C:\Windows\system32\timeout.exetimeout /t 12⤵
- Delays execution with timeout.exe
-
C:\Windows\system32\timeout.exetimeout /t 12⤵
-
C:\Windows\system32\timeout.exetimeout /t 12⤵
-
C:\Windows\system32\timeout.exetimeout /t 12⤵
-
C:\Windows\system32\timeout.exetimeout /t 12⤵
- Delays execution with timeout.exe
-
C:\Windows\system32\timeout.exetimeout /t 12⤵
-
C:\Windows\system32\timeout.exetimeout /t 12⤵
- Delays execution with timeout.exe
-
C:\Windows\system32\timeout.exetimeout /t 12⤵
- Delays execution with timeout.exe
-
C:\Windows\system32\timeout.exetimeout /t 12⤵
-
C:\Windows\system32\timeout.exetimeout /t 12⤵
- Delays execution with timeout.exe
-
C:\Windows\system32\timeout.exetimeout /t 12⤵
-
C:\Windows\system32\timeout.exetimeout /t 12⤵
-
C:\Windows\system32\timeout.exetimeout /t 12⤵
-
C:\Windows\system32\timeout.exetimeout /t 12⤵
-
C:\Windows\system32\timeout.exetimeout /t 12⤵
-
C:\Windows\system32\timeout.exetimeout /t 12⤵
-
C:\Windows\system32\timeout.exetimeout /t 12⤵
- Delays execution with timeout.exe
-
C:\Windows\system32\timeout.exetimeout /t 12⤵
- Delays execution with timeout.exe
-
C:\Windows\system32\timeout.exetimeout /t 12⤵
-
C:\Windows\system32\timeout.exetimeout /t 12⤵
-
C:\Windows\system32\timeout.exetimeout /t 12⤵
-
C:\Windows\system32\timeout.exetimeout /t 12⤵
-
C:\Windows\system32\timeout.exetimeout /t 12⤵
- Delays execution with timeout.exe
-
C:\Windows\system32\timeout.exetimeout /t 12⤵
-
C:\Windows\system32\timeout.exetimeout /t 12⤵
-
C:\Windows\system32\timeout.exetimeout /t 12⤵
-
C:\Windows\system32\timeout.exetimeout /t 12⤵
- Delays execution with timeout.exe
-
C:\Windows\system32\timeout.exetimeout /t 12⤵
-
C:\Windows\system32\timeout.exetimeout /t 12⤵
-
C:\Windows\system32\timeout.exetimeout /t 12⤵
-
C:\Windows\system32\timeout.exetimeout /t 12⤵
- Delays execution with timeout.exe
-
C:\Windows\system32\timeout.exetimeout /t 12⤵
-
C:\Windows\system32\timeout.exetimeout /t 12⤵
-
C:\Windows\system32\timeout.exetimeout /t 12⤵
- Delays execution with timeout.exe
-
C:\Windows\system32\timeout.exetimeout /t 12⤵
- Delays execution with timeout.exe
-
C:\Windows\system32\timeout.exetimeout /t 12⤵
-
C:\Windows\system32\timeout.exetimeout /t 12⤵
-
C:\Windows\system32\timeout.exetimeout /t 12⤵
- Delays execution with timeout.exe
-
C:\Windows\system32\timeout.exetimeout /t 12⤵
-
C:\Windows\system32\timeout.exetimeout /t 12⤵
-
C:\Windows\system32\timeout.exetimeout /t 12⤵
- Delays execution with timeout.exe
-
C:\Windows\system32\timeout.exetimeout /t 12⤵
- Delays execution with timeout.exe
-
C:\Windows\system32\timeout.exetimeout /t 12⤵
- Delays execution with timeout.exe
-
C:\Windows\system32\timeout.exetimeout /t 12⤵
-
C:\Windows\system32\timeout.exetimeout /t 12⤵
-
C:\Windows\system32\timeout.exetimeout /t 12⤵
-
C:\Windows\system32\timeout.exetimeout /t 12⤵
-
C:\Windows\system32\timeout.exetimeout /t 12⤵
-
C:\Windows\system32\timeout.exetimeout /t 12⤵
-
C:\Windows\system32\timeout.exetimeout /t 12⤵
-
C:\Windows\system32\timeout.exetimeout /t 12⤵
-
C:\Windows\system32\timeout.exetimeout /t 12⤵
- Delays execution with timeout.exe
-
C:\Windows\system32\timeout.exetimeout /t 12⤵
- Delays execution with timeout.exe
-
C:\Windows\system32\timeout.exetimeout /t 12⤵
-
C:\Windows\system32\timeout.exetimeout /t 12⤵
- Delays execution with timeout.exe
-
C:\Windows\system32\timeout.exetimeout /t 12⤵
-
C:\Windows\system32\timeout.exetimeout /t 12⤵
-
C:\Windows\system32\timeout.exetimeout /t 12⤵
- Delays execution with timeout.exe
-
C:\Windows\system32\timeout.exetimeout /t 12⤵
- Delays execution with timeout.exe