feea3894cc6f58bf511c7d85283cffdddddeafafab3c272a6c26384f4d13d68e

General

Target

Services.bat
Size

1KB
MD5

15c32ce6b0f03e114d12e3fbddfaf284
SHA1

715c583f291c0bc7cbce70e917efd2088c5f69f4
SHA256

feea3894cc6f58bf511c7d85283cffdddddeafafab3c272a6c26384f4d13d68e
SHA512

053d9ea87e77a480e51a27b63868a234a9563600201076c9b75502cca1c7441e2ad4b65b9496751000a0d9839e8ac953104319ed757db7ad6a8074d0c436f87a

Score

4^/10

Malware Config

Signatures

Launches sc.exe 26 IoCs

Sc.exe is a Windows utlilty to control services on the system.

Processes:

sc.exesc.exesc.exesc.exesc.exesc.exesc.exesc.exesc.exesc.exesc.exesc.exesc.exesc.exesc.exesc.exesc.exesc.exesc.exesc.exesc.exesc.exesc.exesc.exesc.exesc.exe

pid	process
3040	sc.exe
2816	sc.exe
2780	sc.exe
2752	sc.exe
2616	sc.exe
2496	sc.exe
2720	sc.exe
2420	sc.exe
2680	sc.exe
2608	sc.exe
3016	sc.exe
2804	sc.exe
2484	sc.exe
3044	sc.exe
2972	sc.exe
2948	sc.exe
2628	sc.exe
2596	sc.exe
2216	sc.exe
2168	sc.exe
2600	sc.exe
2672	sc.exe
2652	sc.exe
2592	sc.exe
2688	sc.exe
2460	sc.exe

Suspicious use of WriteProcessMemory 64 IoCs

Processes:

cmd.exe

description	pid	process	target process
PID 2868 wrote to memory of 2216	2868	cmd.exe	sc.exe
PID 2868 wrote to memory of 2216	2868	cmd.exe	sc.exe
PID 2868 wrote to memory of 2216	2868	cmd.exe	sc.exe
PID 2868 wrote to memory of 2972	2868	cmd.exe	sc.exe
PID 2868 wrote to memory of 2972	2868	cmd.exe	sc.exe
PID 2868 wrote to memory of 2972	2868	cmd.exe	sc.exe
PID 2868 wrote to memory of 3016	2868	cmd.exe	sc.exe
PID 2868 wrote to memory of 3016	2868	cmd.exe	sc.exe
PID 2868 wrote to memory of 3016	2868	cmd.exe	sc.exe
PID 2868 wrote to memory of 3040	2868	cmd.exe	sc.exe
PID 2868 wrote to memory of 3040	2868	cmd.exe	sc.exe
PID 2868 wrote to memory of 3040	2868	cmd.exe	sc.exe
PID 2868 wrote to memory of 3044	2868	cmd.exe	sc.exe
PID 2868 wrote to memory of 3044	2868	cmd.exe	sc.exe
PID 2868 wrote to memory of 3044	2868	cmd.exe	sc.exe
PID 2868 wrote to memory of 2948	2868	cmd.exe	sc.exe
PID 2868 wrote to memory of 2948	2868	cmd.exe	sc.exe
PID 2868 wrote to memory of 2948	2868	cmd.exe	sc.exe
PID 2868 wrote to memory of 2168	2868	cmd.exe	sc.exe
PID 2868 wrote to memory of 2168	2868	cmd.exe	sc.exe
PID 2868 wrote to memory of 2168	2868	cmd.exe	sc.exe
PID 2868 wrote to memory of 2752	2868	cmd.exe	sc.exe
PID 2868 wrote to memory of 2752	2868	cmd.exe	sc.exe
PID 2868 wrote to memory of 2752	2868	cmd.exe	sc.exe
PID 2868 wrote to memory of 2600	2868	cmd.exe	sc.exe
PID 2868 wrote to memory of 2600	2868	cmd.exe	sc.exe
PID 2868 wrote to memory of 2600	2868	cmd.exe	sc.exe
PID 2868 wrote to memory of 2652	2868	cmd.exe	sc.exe
PID 2868 wrote to memory of 2652	2868	cmd.exe	sc.exe
PID 2868 wrote to memory of 2652	2868	cmd.exe	sc.exe
PID 2868 wrote to memory of 2672	2868	cmd.exe	sc.exe
PID 2868 wrote to memory of 2672	2868	cmd.exe	sc.exe
PID 2868 wrote to memory of 2672	2868	cmd.exe	sc.exe
PID 2868 wrote to memory of 2680	2868	cmd.exe	sc.exe
PID 2868 wrote to memory of 2680	2868	cmd.exe	sc.exe
PID 2868 wrote to memory of 2680	2868	cmd.exe	sc.exe
PID 2868 wrote to memory of 2816	2868	cmd.exe	sc.exe
PID 2868 wrote to memory of 2816	2868	cmd.exe	sc.exe
PID 2868 wrote to memory of 2816	2868	cmd.exe	sc.exe
PID 2868 wrote to memory of 2616	2868	cmd.exe	sc.exe
PID 2868 wrote to memory of 2616	2868	cmd.exe	sc.exe
PID 2868 wrote to memory of 2616	2868	cmd.exe	sc.exe
PID 2868 wrote to memory of 2608	2868	cmd.exe	sc.exe
PID 2868 wrote to memory of 2608	2868	cmd.exe	sc.exe
PID 2868 wrote to memory of 2608	2868	cmd.exe	sc.exe
PID 2868 wrote to memory of 2592	2868	cmd.exe	sc.exe
PID 2868 wrote to memory of 2592	2868	cmd.exe	sc.exe
PID 2868 wrote to memory of 2592	2868	cmd.exe	sc.exe
PID 2868 wrote to memory of 2420	2868	cmd.exe	sc.exe
PID 2868 wrote to memory of 2420	2868	cmd.exe	sc.exe
PID 2868 wrote to memory of 2420	2868	cmd.exe	sc.exe
PID 2868 wrote to memory of 2804	2868	cmd.exe	sc.exe
PID 2868 wrote to memory of 2804	2868	cmd.exe	sc.exe
PID 2868 wrote to memory of 2804	2868	cmd.exe	sc.exe
PID 2868 wrote to memory of 2628	2868	cmd.exe	sc.exe
PID 2868 wrote to memory of 2628	2868	cmd.exe	sc.exe
PID 2868 wrote to memory of 2628	2868	cmd.exe	sc.exe
PID 2868 wrote to memory of 2496	2868	cmd.exe	sc.exe
PID 2868 wrote to memory of 2496	2868	cmd.exe	sc.exe
PID 2868 wrote to memory of 2496	2868	cmd.exe	sc.exe
PID 2868 wrote to memory of 2780	2868	cmd.exe	sc.exe
PID 2868 wrote to memory of 2780	2868	cmd.exe	sc.exe
PID 2868 wrote to memory of 2780	2868	cmd.exe	sc.exe
PID 2868 wrote to memory of 2484	2868	cmd.exe	sc.exe

C:\Windows\system32\cmd.exe
cmd /c "C:\Users\Admin\AppData\Local\Temp\Services.bat"
1⤵
- Suspicious use of WriteProcessMemory
PID:2868

C:\Windows\system32\sc.exe
sc config WSearch start=disabled
2⤵
- Launches sc.exe
PID:2216

C:\Windows\system32\sc.exe
sc config SSDPSRV start=disabled
2⤵
- Launches sc.exe
PID:2972

C:\Windows\system32\sc.exe
sc config lfsvc start=disabled
2⤵
- Launches sc.exe
PID:3016

C:\Windows\system32\sc.exe
sc config AXInstSV start=disabled
2⤵
- Launches sc.exe
PID:3040

C:\Windows\system32\sc.exe
sc config AJRouter start=disabled
2⤵
- Launches sc.exe
PID:3044

C:\Windows\system32\sc.exe
sc config AppReadiness start=disabled
2⤵
- Launches sc.exe
PID:2948

C:\Windows\system32\sc.exe
sc config HomeGroupListener start=disabled
2⤵
- Launches sc.exe
PID:2168

C:\Windows\system32\sc.exe
sc config HomeGroupProvider start=disabled
2⤵
- Launches sc.exe
PID:2752

C:\Windows\system32\sc.exe
sc config SharedAccess start=disabled
2⤵
- Launches sc.exe
PID:2600

C:\Windows\system32\sc.exe
sc config diagnosticshub.standardcollector.service start=disabled
2⤵
- Launches sc.exe
PID:2672

C:\Windows\system32\sc.exe
sc config lltdsvc start=disabled
2⤵
- Launches sc.exe
PID:2652

C:\Windows\system32\sc.exe
sc config wlidsvc start=disabled
2⤵
- Launches sc.exe
PID:2680

C:\Windows\system32\sc.exe
sc config SmsRouter start=disabled
2⤵
- Launches sc.exe
PID:2816

C:\Windows\system32\sc.exe
sc config NcdAutoSetup start=disabled
2⤵
- Launches sc.exe
PID:2616

C:\Windows\system32\sc.exe
sc config PNRPsvc start=disabled
2⤵
- Launches sc.exe
PID:2608

C:\Windows\system32\sc.exe
sc config p2psvc start=disabled
2⤵
- Launches sc.exe
PID:2592

C:\Windows\system32\sc.exe
sc config p2pimsvc start=disabled
2⤵
- Launches sc.exe
PID:2420

C:\Windows\system32\sc.exe
sc config PNRPAutoReg start=disabled
2⤵
- Launches sc.exe
PID:2804

C:\Windows\system32\sc.exe
sc config WalletService start=disabled
2⤵
- Launches sc.exe
PID:2628

C:\Windows\system32\sc.exe
sc config WMPNetworkSvc start=disabled
2⤵
- Launches sc.exe
PID:2496

C:\Windows\system32\sc.exe
sc config icssvc start=disabled
2⤵
- Launches sc.exe
PID:2780

C:\Windows\system32\sc.exe
sc config XblAuthManager start=disabled
2⤵
- Launches sc.exe
PID:2484

C:\Windows\system32\sc.exe
sc config XblGameSave start=disabled
2⤵
- Launches sc.exe
PID:2596

C:\Windows\system32\sc.exe
sc config XboxNetApiSvc start=disabled
2⤵
- Launches sc.exe
PID:2688

C:\Windows\system32\sc.exe
sc config DmEnrollmentSvc start=disabled
2⤵
- Launches sc.exe
PID:2720

C:\Windows\system32\sc.exe
sc config RetailDemo start=disabled
2⤵
- Launches sc.exe
PID:2460

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads