f30060ca8b3b98de0626ccaf9157fd6c4930217753b5f2cca9785ab1b08e614c

Analysis

max time kernel
121s
max time network
125s
platform
windows7_x64
resource
win7-20230831-en
resource tags

arch:x64arch:x86image:win7-20230831-enlocale:en-usos:windows7-x64system
submitted
12-10-2023 13:13

Target

ransomm.bat
Size

75KB
MD5

e674c025181f33d469af4aca672d2717
SHA1

d509c5b32a86fda20d88e3b54638f7cd0eef15d6
SHA256

f30060ca8b3b98de0626ccaf9157fd6c4930217753b5f2cca9785ab1b08e614c
SHA512

5bd5aa4e6a3b8b47d1cbce3b875c63e1170a78539fc318751f6dc45a5166821f6107899e059a0bc352992415be4c67f8fc6bc8efb6fe8d2c4b4fd5af73e31d39
SSDEEP

384:ymB8m9Vm9hm9Tm9Tm91ml5mlomlumlSmlcmlsmlkmllmlZmjDmlfmn7mlJmlTmlA:XNkIee4cBn7Vl9oemQes2kZDx

Score

1^/10

Kills process with taskkill 1 IoCs

evasion

pid	Process
2208	taskkill.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	2208	taskkill.exe

Suspicious use of WriteProcessMemory 6 IoCs

description	pid	Process	procid_target
PID 2988 wrote to memory of 2408	2988	cmd.exe	29
PID 2988 wrote to memory of 2408	2988	cmd.exe	29
PID 2988 wrote to memory of 2408	2988	cmd.exe	29
PID 2988 wrote to memory of 2208	2988	cmd.exe	30
PID 2988 wrote to memory of 2208	2988	cmd.exe	30
PID 2988 wrote to memory of 2208	2988	cmd.exe	30

C:\Windows\system32\cmd.exe
cmd /c "C:\Users\Admin\AppData\Local\Temp\ransomm.bat"
1⤵
- Suspicious use of WriteProcessMemory
PID:2988
- C:\Windows\system32\mode.com
  mode con cols=107 lines=41
  2⤵
  PID:2408
- C:\Windows\system32\taskkill.exe
  taskkill /f /im explorer.exe
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:2208