ae27243a53f4c399aeb6bb39e67fa79f8378d51ef6b4fef9263791ec1acb6e78

Analysis

max time kernel
145s
max time network
157s
platform
windows10-2004_x64
resource
win10v2004-20231215-en
resource tags

arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
submitted
01/01/2024, 02:50

Target

BadwareFree.exe
Size

7.2MB
MD5

6ec04fa24f0695f286801366108942f3
SHA1

309ee6a08c8ab0159dc3137865b6cfeb9f3e4e04
SHA256

ae27243a53f4c399aeb6bb39e67fa79f8378d51ef6b4fef9263791ec1acb6e78
SHA512

d835f387bb19b353f58eb72a94c2b32857826f3f1322c7b5be253a6dc3b2c6a9cf4cd0340ab001df74092899346bd0e4d1dfa8c5c8d77a2893b418311103a6b5
SSDEEP

98304:cMYzS+CQQ4vBmVK0Psj6+qU483Aj9urJBSzrAhzZVT6e3JKPfjV4ZTNy6oeZ2gCc:KS4qKsW80FIryV4fZo0/

Score

5^/10

Suspicious use of NtSetInformationThreadHideFromDebugger 2 IoCs

pid	Process
1224	BadwareFree.exe
1224	BadwareFree.exe

Kills process with taskkill 1 IoCs

evasion

pid	Process
3420	taskkill.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
1224	BadwareFree.exe
1224	BadwareFree.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	3420	taskkill.exe

Suspicious use of WriteProcessMemory 10 IoCs

description	pid	Process	procid_target
PID 1224 wrote to memory of 3740	1224	BadwareFree.exe	44
PID 1224 wrote to memory of 3740	1224	BadwareFree.exe	44
PID 1224 wrote to memory of 1944	1224	BadwareFree.exe	49
PID 1224 wrote to memory of 1944	1224	BadwareFree.exe	49
PID 1944 wrote to memory of 3420	1944	cmd.exe	46
PID 1944 wrote to memory of 3420	1944	cmd.exe	46
PID 1224 wrote to memory of 2024	1224	BadwareFree.exe	50
PID 1224 wrote to memory of 2024	1224	BadwareFree.exe	50
PID 1224 wrote to memory of 5072	1224	BadwareFree.exe	51
PID 1224 wrote to memory of 5072	1224	BadwareFree.exe	51

C:\Users\Admin\AppData\Local\Temp\BadwareFree.exe
"C:\Users\Admin\AppData\Local\Temp\BadwareFree.exe"
1⤵
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:1224
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c color 04
  2⤵
  PID:3740
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c taskkill /f /im epicgameslauncher.exe >nul 2>&1
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1944
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c cls
  2⤵
  PID:2024
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c cls
  2⤵
  PID:5072

memory/1224-0-0x00007FFC26830000-0x00007FFC26832000-memory.dmp

Filesize
8KB

Download
memory/1224-2-0x0000000140000000-0x0000000140F9C000-memory.dmp

Filesize
15.6MB

Download
memory/1224-1-0x0000000140000000-0x0000000140F9C000-memory.dmp

Filesize
15.6MB

Download
memory/1224-6-0x0000000140000000-0x0000000140F9C000-memory.dmp

Filesize
15.6MB

Download