Analysis
-
max time kernel
75s -
max time network
66s -
platform
windows10-2004_x64 -
resource
win10v2004-20230621-en -
resource tags
arch:x64arch:x86image:win10v2004-20230621-enlocale:en-usos:windows10-2004-x64system -
submitted
29/06/2023, 23:35
Static task
static1
Behavioral task
behavioral1
Sample
gufno.bat
Resource
win10v2004-20230621-en
windows10-2004-x64
10 signatures
1800 seconds
General
-
Target
gufno.bat
-
Size
694B
-
MD5
4eb8f4be133f9958050d6177d90a693e
-
SHA1
51ce3c8562baa4be080397f7accd0a36dc69d018
-
SHA256
3c131de31151624b3ba7ee290fc75025b3560da5aeedc18eb87072767d4aced3
-
SHA512
34efb864acfb6cc7f2b11c28acc8e3bedaae345b47fc930f562f27e1b10fe427ac0904b441b4add9b3c80385d2b3c76d218525161608c571bd2d94dedd2b4d96
Score
7/10
Malware Config
Signatures
-
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-3259792829-1422303781-2047321929-1000\Control Panel\International\Geo\Nation cmd.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Checks SCSI registry key(s) 3 TTPs 3 IoCs
SCSI information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000 taskmgr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A taskmgr.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\FriendlyName taskmgr.exe -
Checks processor information in registry 2 TTPs 2 IoCs
Processor information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 taskmgr.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString taskmgr.exe -
Modifies registry class 1 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-21-3259792829-1422303781-2047321929-1000_Classes\Local Settings cmd.exe -
Suspicious behavior: EnumeratesProcesses 18 IoCs
pid Process 4952 taskmgr.exe 4952 taskmgr.exe 4952 taskmgr.exe 4952 taskmgr.exe 4952 taskmgr.exe 4952 taskmgr.exe 4952 taskmgr.exe 4952 taskmgr.exe 4952 taskmgr.exe 4952 taskmgr.exe 4952 taskmgr.exe 4952 taskmgr.exe 4952 taskmgr.exe 4952 taskmgr.exe 4952 taskmgr.exe 4952 taskmgr.exe 4952 taskmgr.exe 4952 taskmgr.exe -
Suspicious use of AdjustPrivilegeToken 5 IoCs
description pid Process Token: SeDebugPrivilege 4952 taskmgr.exe Token: SeSystemProfilePrivilege 4952 taskmgr.exe Token: SeCreateGlobalPrivilege 4952 taskmgr.exe Token: 33 4952 taskmgr.exe Token: SeIncBasePriorityPrivilege 4952 taskmgr.exe -
Suspicious use of FindShellTrayWindow 44 IoCs
pid Process 4952 taskmgr.exe 4952 taskmgr.exe 4952 taskmgr.exe 4952 taskmgr.exe 4952 taskmgr.exe 4952 taskmgr.exe 4952 taskmgr.exe 4952 taskmgr.exe 4952 taskmgr.exe 4952 taskmgr.exe 4952 taskmgr.exe 4952 taskmgr.exe 4952 taskmgr.exe 4952 taskmgr.exe 4952 taskmgr.exe 4952 taskmgr.exe 4952 taskmgr.exe 4952 taskmgr.exe 4952 taskmgr.exe 4952 taskmgr.exe 4952 taskmgr.exe 4952 taskmgr.exe 4952 taskmgr.exe 4952 taskmgr.exe 4952 taskmgr.exe 4952 taskmgr.exe 4952 taskmgr.exe 4952 taskmgr.exe 4952 taskmgr.exe 4952 taskmgr.exe 4952 taskmgr.exe 4952 taskmgr.exe 4952 taskmgr.exe 4952 taskmgr.exe 4952 taskmgr.exe 4952 taskmgr.exe 4952 taskmgr.exe 4952 taskmgr.exe 4952 taskmgr.exe 4952 taskmgr.exe 4952 taskmgr.exe 4952 taskmgr.exe 4952 taskmgr.exe 4952 taskmgr.exe -
Suspicious use of SendNotifyMessage 44 IoCs
pid Process 4952 taskmgr.exe 4952 taskmgr.exe 4952 taskmgr.exe 4952 taskmgr.exe 4952 taskmgr.exe 4952 taskmgr.exe 4952 taskmgr.exe 4952 taskmgr.exe 4952 taskmgr.exe 4952 taskmgr.exe 4952 taskmgr.exe 4952 taskmgr.exe 4952 taskmgr.exe 4952 taskmgr.exe 4952 taskmgr.exe 4952 taskmgr.exe 4952 taskmgr.exe 4952 taskmgr.exe 4952 taskmgr.exe 4952 taskmgr.exe 4952 taskmgr.exe 4952 taskmgr.exe 4952 taskmgr.exe 4952 taskmgr.exe 4952 taskmgr.exe 4952 taskmgr.exe 4952 taskmgr.exe 4952 taskmgr.exe 4952 taskmgr.exe 4952 taskmgr.exe 4952 taskmgr.exe 4952 taskmgr.exe 4952 taskmgr.exe 4952 taskmgr.exe 4952 taskmgr.exe 4952 taskmgr.exe 4952 taskmgr.exe 4952 taskmgr.exe 4952 taskmgr.exe 4952 taskmgr.exe 4952 taskmgr.exe 4952 taskmgr.exe 4952 taskmgr.exe 4952 taskmgr.exe -
Suspicious use of WriteProcessMemory 8 IoCs
description pid Process procid_target PID 4428 wrote to memory of 3312 4428 cmd.exe 80 PID 4428 wrote to memory of 3312 4428 cmd.exe 80 PID 4428 wrote to memory of 2332 4428 cmd.exe 81 PID 4428 wrote to memory of 2332 4428 cmd.exe 81 PID 4428 wrote to memory of 4252 4428 cmd.exe 91 PID 4428 wrote to memory of 4252 4428 cmd.exe 91 PID 4428 wrote to memory of 4188 4428 cmd.exe 93 PID 4428 wrote to memory of 4188 4428 cmd.exe 93
Processes
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\gufno.bat"1⤵
- Checks computer location settings
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:4428 -
C:\Windows\system32\cacls.exe"C:\Windows\system32\cacls.exe" "C:\Windows\system32\config\system"2⤵PID:3312
-
-
C:\Windows\System32\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Windows\system32\slmgr.vbs" /ipk W269N-WFGWX-YVC9B-4J6C9-T83GX2⤵PID:2332
-
-
C:\Windows\System32\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Windows\system32\slmgr.vbs" /skms kms8.msguides.com2⤵PID:4252
-
-
C:\Windows\System32\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Windows\system32\slmgr.vbs" /ato2⤵PID:4188
-
-
C:\Windows\System32\rundll32.exeC:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding1⤵PID:4196
-
C:\Windows\system32\taskmgr.exe"C:\Windows\system32\taskmgr.exe" /71⤵
- Checks SCSI registry key(s)
- Checks processor information in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:4952