df6962bda69e8939ffe4c4dafd96757a45a6ed308ee6b153304658385a9d19e8 | Triage

Analysis

max time kernel
32s
max time network
33s
platform
windows7_x64
resource
win7-20230220-en
resource tags

arch:x64arch:x86image:win7-20230220-enlocale:en-usos:windows7-x64system
submitted
17-04-2023 15:11

Sharing

Report Analysis Logs

General

Target

HmUnban.bat
Size

2KB
MD5

1719d598ec3f8e8439a0da90ff9baa9d
SHA1

14e4e92dcf6cf251b1d6896120bedf54dc37e39d
SHA256

df6962bda69e8939ffe4c4dafd96757a45a6ed308ee6b153304658385a9d19e8
SHA512

e9d4c613e0b17776c76b911c998cd428cf255a78d196a511f40fe287b15b99ac6ae60251278678789b9d28bde05cb98c8aaa4f602262ddc29fec4f5dd30aef54

Score

7^/10

Malware Config

Signatures

Deletes itself 1 IoCs

pid	Process
1320	cmd.exe

Kills process with taskkill 3 IoCs

pid	Process
1284	taskkill.exe
772	taskkill.exe
600	taskkill.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

description	pid	Process
Token: SeDebugPrivilege	1284	taskkill.exe
Token: SeDebugPrivilege	772	taskkill.exe
Token: SeDebugPrivilege	600	taskkill.exe

Suspicious use of WriteProcessMemory 9 IoCs

description	pid	Process	procid_target
PID 1320 wrote to memory of 1284	1320	cmd.exe	29
PID 1320 wrote to memory of 1284	1320	cmd.exe	29
PID 1320 wrote to memory of 1284	1320	cmd.exe	29
PID 1320 wrote to memory of 772	1320	cmd.exe	31
PID 1320 wrote to memory of 772	1320	cmd.exe	31
PID 1320 wrote to memory of 772	1320	cmd.exe	31
PID 1320 wrote to memory of 600	1320	cmd.exe	32
PID 1320 wrote to memory of 600	1320	cmd.exe	32
PID 1320 wrote to memory of 600	1320	cmd.exe	32

C:\Windows\system32\cmd.exe
cmd /c "C:\Users\Admin\AppData\Local\Temp\HmUnban.bat"
1⤵
- Deletes itself
- Suspicious use of WriteProcessMemory
PID:1320
- C:\Windows\system32\taskkill.exe
  taskkill /f /im FiveM.exe
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:1284
- C:\Windows\system32\taskkill.exe
  taskkill /f /im steam.exe
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:772
- C:\Windows\system32\taskkill.exe
  taskkill /f /im EpicGamesLauncher.exe
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:600

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads