Analysis
-
max time kernel
122s -
max time network
126s -
platform
windows7_x64 -
resource
win7-20231215-en -
resource tags
arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system -
submitted
12-02-2024 20:22
Static task
static1
Behavioral task
behavioral1
Sample
Exm_Premium_Utility_0.95_1_1.bat
Resource
win7-20231215-en
windows7-x64
4 signatures
150 seconds
Behavioral task
behavioral2
Sample
Exm_Premium_Utility_0.95_1_1.bat
Resource
win10v2004-20231222-en
windows10-2004-x64
19 signatures
150 seconds
General
-
Target
Exm_Premium_Utility_0.95_1_1.bat
-
Size
661KB
-
MD5
73381d44050ec2fbcecbfc9a6bfb0bb3
-
SHA1
578bc26c2da8d5cd30732a977f3cbf0eecda168a
-
SHA256
7566d9f5bdbaf8073179d794ebb920dcdd02f249d4e46ea062e8315532ceca51
-
SHA512
31552773c791f925c009292f7ebc27e768ed2c94809c11048756593e4f9598bd72d6f37648978caadce9293eb0f789d05eb4234d6dcbcbbafc57a0f4142009d8
-
SSDEEP
3072:FDGzQbmbkAqA2xH7VkKEn14IZVvisLur+K3:FDGiVNEn14IZVvisL43
Malware Config
Signatures
-
Processes:
reg.exedescription ioc process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe -
Suspicious behavior: EnumeratesProcesses 1 IoCs
Processes:
powershell.exepid process 3040 powershell.exe -
Suspicious use of AdjustPrivilegeToken 41 IoCs
Processes:
powershell.exeWMIC.exedescription pid process Token: SeDebugPrivilege 3040 powershell.exe Token: SeIncreaseQuotaPrivilege 2968 WMIC.exe Token: SeSecurityPrivilege 2968 WMIC.exe Token: SeTakeOwnershipPrivilege 2968 WMIC.exe Token: SeLoadDriverPrivilege 2968 WMIC.exe Token: SeSystemProfilePrivilege 2968 WMIC.exe Token: SeSystemtimePrivilege 2968 WMIC.exe Token: SeProfSingleProcessPrivilege 2968 WMIC.exe Token: SeIncBasePriorityPrivilege 2968 WMIC.exe Token: SeCreatePagefilePrivilege 2968 WMIC.exe Token: SeBackupPrivilege 2968 WMIC.exe Token: SeRestorePrivilege 2968 WMIC.exe Token: SeShutdownPrivilege 2968 WMIC.exe Token: SeDebugPrivilege 2968 WMIC.exe Token: SeSystemEnvironmentPrivilege 2968 WMIC.exe Token: SeRemoteShutdownPrivilege 2968 WMIC.exe Token: SeUndockPrivilege 2968 WMIC.exe Token: SeManageVolumePrivilege 2968 WMIC.exe Token: 33 2968 WMIC.exe Token: 34 2968 WMIC.exe Token: 35 2968 WMIC.exe Token: SeIncreaseQuotaPrivilege 2968 WMIC.exe Token: SeSecurityPrivilege 2968 WMIC.exe Token: SeTakeOwnershipPrivilege 2968 WMIC.exe Token: SeLoadDriverPrivilege 2968 WMIC.exe Token: SeSystemProfilePrivilege 2968 WMIC.exe Token: SeSystemtimePrivilege 2968 WMIC.exe Token: SeProfSingleProcessPrivilege 2968 WMIC.exe Token: SeIncBasePriorityPrivilege 2968 WMIC.exe Token: SeCreatePagefilePrivilege 2968 WMIC.exe Token: SeBackupPrivilege 2968 WMIC.exe Token: SeRestorePrivilege 2968 WMIC.exe Token: SeShutdownPrivilege 2968 WMIC.exe Token: SeDebugPrivilege 2968 WMIC.exe Token: SeSystemEnvironmentPrivilege 2968 WMIC.exe Token: SeRemoteShutdownPrivilege 2968 WMIC.exe Token: SeUndockPrivilege 2968 WMIC.exe Token: SeManageVolumePrivilege 2968 WMIC.exe Token: 33 2968 WMIC.exe Token: 34 2968 WMIC.exe Token: 35 2968 WMIC.exe -
Suspicious use of WriteProcessMemory 30 IoCs
Processes:
cmd.execmd.exedescription pid process target process PID 3036 wrote to memory of 2500 3036 cmd.exe reg.exe PID 3036 wrote to memory of 2500 3036 cmd.exe reg.exe PID 3036 wrote to memory of 2500 3036 cmd.exe reg.exe PID 3036 wrote to memory of 2132 3036 cmd.exe reg.exe PID 3036 wrote to memory of 2132 3036 cmd.exe reg.exe PID 3036 wrote to memory of 2132 3036 cmd.exe reg.exe PID 3036 wrote to memory of 1740 3036 cmd.exe reg.exe PID 3036 wrote to memory of 1740 3036 cmd.exe reg.exe PID 3036 wrote to memory of 1740 3036 cmd.exe reg.exe PID 3036 wrote to memory of 3040 3036 cmd.exe powershell.exe PID 3036 wrote to memory of 3040 3036 cmd.exe powershell.exe PID 3036 wrote to memory of 3040 3036 cmd.exe powershell.exe PID 3036 wrote to memory of 2672 3036 cmd.exe reg.exe PID 3036 wrote to memory of 2672 3036 cmd.exe reg.exe PID 3036 wrote to memory of 2672 3036 cmd.exe reg.exe PID 3036 wrote to memory of 2760 3036 cmd.exe reg.exe PID 3036 wrote to memory of 2760 3036 cmd.exe reg.exe PID 3036 wrote to memory of 2760 3036 cmd.exe reg.exe PID 3036 wrote to memory of 2588 3036 cmd.exe cmd.exe PID 3036 wrote to memory of 2588 3036 cmd.exe cmd.exe PID 3036 wrote to memory of 2588 3036 cmd.exe cmd.exe PID 2588 wrote to memory of 2968 2588 cmd.exe WMIC.exe PID 2588 wrote to memory of 2968 2588 cmd.exe WMIC.exe PID 2588 wrote to memory of 2968 2588 cmd.exe WMIC.exe PID 2588 wrote to memory of 2576 2588 cmd.exe findstr.exe PID 2588 wrote to memory of 2576 2588 cmd.exe findstr.exe PID 2588 wrote to memory of 2576 2588 cmd.exe findstr.exe PID 3036 wrote to memory of 2608 3036 cmd.exe chcp.com PID 3036 wrote to memory of 2608 3036 cmd.exe chcp.com PID 3036 wrote to memory of 2608 3036 cmd.exe chcp.com
Processes
-
C:\Windows\system32\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\Exm_Premium_Utility_0.95_1_1.bat"1⤵
- Suspicious use of WriteProcessMemory
PID:3036 -
C:\Windows\system32\reg.exeReg.exe delete "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WindowsNT\CurrentVersion\SystemRestore" /v "RPSessionInterval" /f2⤵PID:2500
-
C:\Windows\system32\reg.exeReg.exe delete "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WindowsNT\CurrentVersion\SystemRestore" /v "DisableConfig" /f2⤵PID:2132
-
C:\Windows\system32\reg.exeReg.exe add "HKLM\Software\Microsoft\Windows NT\CurrentVersion\SystemRestore" /v "SystemRestorePointCreationFrequency" /t REG_DWORD /d 0 /f2⤵PID:1740
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell -ExecutionPolicy Unrestricted -NoProfile Enable-ComputerRestore -Drive 'C:\'2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3040 -
C:\Windows\system32\reg.exeReg.exe ADD "HKLM\Software\Microsoft\Windows\CurrentVersion\Policies\System" /v "EnableLUA" /t REG_DWORD /d "0" /f2⤵
- UAC bypass
PID:2672 -
C:\Windows\system32\reg.exeReg.exe add "HKCU\CONSOLE" /v "VirtualTerminalLevel" /t REG_DWORD /d "1" /f2⤵PID:2760
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic path Win32_UserAccount where name="Admin" get sid | findstr "S-"2⤵
- Suspicious use of WriteProcessMemory
PID:2588 -
C:\Windows\System32\Wbem\WMIC.exewmic path Win32_UserAccount where name="Admin" get sid3⤵
- Suspicious use of AdjustPrivilegeToken
PID:2968 -
C:\Windows\system32\findstr.exefindstr "S-"3⤵PID:2576
-
C:\Windows\system32\chcp.comchcp 650012⤵PID:2608