e66264065923676807fd6d7b36f7c9dc52db9ef1c5399b2811738eb5e22a30f6 | Triage

Analysis

max time kernel
149s
max time network
149s
platform
windows10-2004_x64
resource
win10v2004-20240220-en
resource tags

arch:x64arch:x86image:win10v2004-20240220-enlocale:en-usos:windows10-2004-x64system
submitted
20/02/2024, 15:50

Sharing

Report Analysis Logs

General

Target

Desktop Goose v0.31/DesktopGoose v0.31/Close Goose.bat
Size

31B
MD5

1fdef6890e156b9aa7b662a4314dc712
SHA1

0c1e18150345fc43924c96844b8fd0fc53ec8855
SHA256

9d3b5a6370f076a57651fcf06fc4f3fbce8d9e5156642e22141a8f521f35ffdc
SHA512

474b7169f7a2deca1298391c42b0d5a8cb55b33853eaf1d79026c9b9b45d9a687582a0aa0d0ff639e5d9b40535cda3b3827546d26f1d35fa9169bcd73f050d29

Score

1^/10

Malware Config

Signatures

Kills process with taskkill 1 IoCs

pid	Process
4860	taskkill.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	4860	taskkill.exe

Suspicious use of WriteProcessMemory 2 IoCs

description	pid	Process	procid_target
PID 3932 wrote to memory of 4860	3932	cmd.exe	86
PID 3932 wrote to memory of 4860	3932	cmd.exe	86

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\Desktop Goose v0.31\DesktopGoose v0.31\Close Goose.bat"
1⤵
- Suspicious use of WriteProcessMemory
PID:3932
- C:\Windows\system32\taskkill.exe
  taskkill /f /im goosedesktop.exe
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:4860

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads