f30060ca8b3b98de0626ccaf9157fd6c4930217753b5f2cca9785ab1b08e614c

Analysis

max time kernel
127s
max time network
153s
platform
windows10-2004_x64
resource
win10v2004-20230915-en
resource tags

arch:x64arch:x86image:win10v2004-20230915-enlocale:en-usos:windows10-2004-x64system
submitted
12-10-2023 13:13

Target

ransomm.bat
Size

75KB
MD5

e674c025181f33d469af4aca672d2717
SHA1

d509c5b32a86fda20d88e3b54638f7cd0eef15d6
SHA256

f30060ca8b3b98de0626ccaf9157fd6c4930217753b5f2cca9785ab1b08e614c
SHA512

5bd5aa4e6a3b8b47d1cbce3b875c63e1170a78539fc318751f6dc45a5166821f6107899e059a0bc352992415be4c67f8fc6bc8efb6fe8d2c4b4fd5af73e31d39
SSDEEP

384:ymB8m9Vm9hm9Tm9Tm91ml5mlomlumlSmlcmlsmlkmllmlZmjDmlfmn7mlJmlTmlA:XNkIee4cBn7Vl9oemQes2kZDx

Score

1^/10

Kills process with taskkill 1 IoCs

evasion

pid	Process
2420	taskkill.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	2420	taskkill.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 3756 wrote to memory of 2552	3756	cmd.exe	84
PID 3756 wrote to memory of 2552	3756	cmd.exe	84
PID 3756 wrote to memory of 2420	3756	cmd.exe	85
PID 3756 wrote to memory of 2420	3756	cmd.exe	85

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\ransomm.bat"
1⤵
- Suspicious use of WriteProcessMemory
PID:3756
- C:\Windows\system32\mode.com
  mode con cols=107 lines=41
  2⤵
  PID:2552
- C:\Windows\system32\taskkill.exe
  taskkill /f /im explorer.exe
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:2420