9d3fe04d88c401178165f7fbdf307ac0fb690cc5fef8b70ee7f380307d4748f8

Analysis

max time kernel
0s
max time network
18s
platform
windows10-2004_x64
resource
win10v2004-20231215-en
resource tags

arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
submitted
06-01-2024 16:11

Sharing

Copy URL

Twitter E-mail

Reason

Machine shutdown

Report Analysis Logs

General

Target

[email protected]
Size

6.7MB
MD5

f2b7074e1543720a9a98fda660e02688
SHA1

1029492c1a12789d8af78d54adcb921e24b9e5ca
SHA256

4ea1f2ecf7eb12896f2cbf8683dae8546d2b8dc43cf7710d68ce99e127c0a966
SHA512

73f9548633bc38bab64b1dd5a01401ef7f5b139163bdf291cc475dbd2613510c4c5e4d7702ecdfa74b49f3c9eaed37ed23b9d8f0064c66123eb0769c8671c6ff
SSDEEP

3072:eaLA1++iCeFj0im6X/AXpT8vVMCcHVcdhghUuz1o9Y:fLJlC6j0CX4XmvWHVcd62uO9

Score

1^/10

Malware Config

Signatures

Kills process with taskkill 2 IoCs

evasion

pid	Process
3120	taskkill.exe
2872	taskkill.exe

C:\Users\Admin\AppData\Local\Temp\[email protected]
"C:\Users\Admin\AppData\Local\Temp\[email protected]"
1⤵
PID:2296
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\windl.bat""
  2⤵
  PID:4076
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f /im taskmgr.exe
    3⤵
    - Kills process with taskkill
    PID:2872
- - C:\Windows\SysWOW64\Wbem\WMIC.exe
    wmic useraccount where name='Admin' set FullName='UR NEXT'
    3⤵
    PID:3708
- - C:\Windows\SysWOW64\Wbem\WMIC.exe
    wmic useraccount where name='Admin' rename 'UR NEXT'
    3⤵
    PID:4536
- - C:\Windows\SysWOW64\shutdown.exe
    shutdown /f /r /t 0
    3⤵
    PID:2516

C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im explorer.exe
1⤵
- Kills process with taskkill
PID:3120

C:\Windows\system32\LogonUI.exe
"LogonUI.exe" /flags:0x4 /state0:0xa3945855 /state1:0x41c64e6d
1⤵
PID:872

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Windows Media\12.0\WMSDKNS.XML.bak

Filesize
9KB

MD5
7050d5ae8acfbe560fa11073fef8185d

SHA1
5bc38e77ff06785fe0aec5a345c4ccd15752560e

SHA256
cb87767c4a384c24e4a0f88455f59101b1ae7b4fb8de8a5adb4136c5f7ee545b

SHA512
a7a295ac8921bb3dde58d4bcde9372ed59def61d4b7699057274960fa8c1d1a1daff834a93f7a0698e9e5c16db43af05e9fd2d6d7c9232f7d26ffcff5fc5900b

Download Submit
memory/2296-38-0x000000000B6E0000-0x000000000B6F0000-memory.dmp

Filesize
64KB

Download
memory/2296-865-0x0000000005570000-0x0000000005580000-memory.dmp

Filesize
64KB

Download
memory/2296-2-0x0000000005570000-0x0000000005580000-memory.dmp

Filesize
64KB

Download
memory/2296-11-0x0000000005570000-0x0000000005580000-memory.dmp

Filesize
64KB

Download
memory/2296-23-0x000000000B580000-0x000000000B58E000-memory.dmp

Filesize
56KB

Download
memory/2296-29-0x000000000B620000-0x000000000B630000-memory.dmp

Filesize
64KB

Download
memory/2296-30-0x000000000B620000-0x000000000B630000-memory.dmp

Filesize
64KB

Download
memory/2296-35-0x000000000B620000-0x000000000B630000-memory.dmp

Filesize
64KB

Download
memory/2296-33-0x000000000B620000-0x000000000B630000-memory.dmp

Filesize
64KB

Download
memory/2296-36-0x000000000B6E0000-0x000000000B6F0000-memory.dmp

Filesize
64KB

Download
memory/2296-867-0x0000000074910000-0x00000000750C0000-memory.dmp

Filesize
7.7MB

Download
memory/2296-3-0x0000000005B30000-0x00000000060D4000-memory.dmp

Filesize
5.6MB

Download
memory/2296-45-0x000000000B620000-0x000000000B630000-memory.dmp

Filesize
64KB

Download
memory/2296-46-0x000000000B6E0000-0x000000000B6F0000-memory.dmp

Filesize
64KB

Download
memory/2296-43-0x000000000B6E0000-0x000000000B6F0000-memory.dmp

Filesize
64KB

Download
memory/2296-44-0x0000000074910000-0x00000000750C0000-memory.dmp

Filesize
7.7MB

Download
memory/2296-42-0x000000000B620000-0x000000000B630000-memory.dmp

Filesize
64KB

Download
memory/2296-39-0x000000000B620000-0x000000000B630000-memory.dmp

Filesize
64KB

Download
memory/2296-32-0x000000000B620000-0x000000000B630000-memory.dmp

Filesize
64KB

Download
memory/2296-22-0x000000000B5C0000-0x000000000B5F8000-memory.dmp

Filesize
224KB

Download
memory/2296-0-0x0000000074910000-0x00000000750C0000-memory.dmp

Filesize
7.7MB

Download
memory/2296-40-0x000000000B6E0000-0x000000000B6F0000-memory.dmp

Filesize
64KB

Download
memory/2296-866-0x0000000005570000-0x0000000005580000-memory.dmp

Filesize
64KB

Download
memory/2296-1-0x00000000003B0000-0x0000000000A5E000-memory.dmp

Filesize
6.7MB

Download

Analysis

Sharing

Errors

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads