010853c68afab082f1ad93787851feba647c634c60b3d033b4c8066a5734e496

Analysis

max time kernel
117s
max time network
121s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
24/01/2024, 04:38

Target

Network Optimizer.bat
Size

713B
MD5

b63146f5589597d2e4b77d5b833013d7
SHA1

4860468d6048cd86274899e6f48cb2bd07f4ae15
SHA256

f436ac7c6a86ca3f3b7fc2c19ae36bcbf482d5c902b48b9464b7ae37ebd1b446
SHA512

321b690c9939e286e548bd21847e91e3c68fd96c7053fe4d99c835f134cd22312d38f00b26624adce3dbb5ec77debfe24a7a37259d0ed6f3a89cdb45b4f7acf2

Score

1^/10

Kills process with taskkill 1 IoCs

evasion

pid	Process
2200	taskkill.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	2200	taskkill.exe

Suspicious use of WriteProcessMemory 21 IoCs

description	pid	Process	procid_target
PID 2520 wrote to memory of 2200	2520	cmd.exe	29
PID 2520 wrote to memory of 2200	2520	cmd.exe	29
PID 2520 wrote to memory of 2200	2520	cmd.exe	29
PID 2520 wrote to memory of 2756	2520	cmd.exe	31
PID 2520 wrote to memory of 2756	2520	cmd.exe	31
PID 2520 wrote to memory of 2756	2520	cmd.exe	31
PID 2520 wrote to memory of 2796	2520	cmd.exe	32
PID 2520 wrote to memory of 2796	2520	cmd.exe	32
PID 2520 wrote to memory of 2796	2520	cmd.exe	32
PID 2520 wrote to memory of 2852	2520	cmd.exe	33
PID 2520 wrote to memory of 2852	2520	cmd.exe	33
PID 2520 wrote to memory of 2852	2520	cmd.exe	33
PID 2520 wrote to memory of 2712	2520	cmd.exe	34
PID 2520 wrote to memory of 2712	2520	cmd.exe	34
PID 2520 wrote to memory of 2712	2520	cmd.exe	34
PID 2520 wrote to memory of 2704	2520	cmd.exe	35
PID 2520 wrote to memory of 2704	2520	cmd.exe	35
PID 2520 wrote to memory of 2704	2520	cmd.exe	35
PID 2520 wrote to memory of 2776	2520	cmd.exe	36
PID 2520 wrote to memory of 2776	2520	cmd.exe	36
PID 2520 wrote to memory of 2776	2520	cmd.exe	36

C:\Windows\system32\cmd.exe
cmd /c "C:\Users\Admin\AppData\Local\Temp\Network Optimizer.bat"
1⤵
- Suspicious use of WriteProcessMemory
PID:2520
- C:\Windows\system32\taskkill.exe
  taskkill /f /im explorer.exe
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:2200
- C:\Windows\system32\msg.exe
  msg * No apagues tu computadora
  2⤵
  PID:2756
- C:\Windows\system32\msg.exe
  msg * Si no tus archivos seran encriptados
  2⤵
  PID:2796
- C:\Windows\system32\msg.exe
  msg * y robados :)
  2⤵
  PID:2852
- C:\Windows\system32\msg.exe
  msg * Acordate que nada sale gratis!
  2⤵
  PID:2712
- C:\Windows\system32\msg.exe
  msg * gg
  2⤵
  PID:2704
- C:\Windows\system32\msg.exe
  msg * gg
  2⤵
  PID:2776