Overview
overview
8Static
static
3MicrosoftW...ll.bat
windows7-x64
1MicrosoftW...ll.bat
windows10-2004-x64
1MicrosoftW...nc.vbs
windows7-x64
3MicrosoftW...nc.vbs
windows10-2004-x64
7MicrosoftW...un.vbs
windows7-x64
3MicrosoftW...un.vbs
windows10-2004-x64
7MicrosoftW...dy.exe
windows7-x64
8MicrosoftW...dy.exe
windows10-2004-x64
8MicrosoftW...or.exe
windows7-x64
3MicrosoftW...or.exe
windows10-2004-x64
7MicrosoftW...ch.exe
windows7-x64
1MicrosoftW...ch.exe
windows10-2004-x64
1MicrosoftW...er.exe
windows7-x64
3MicrosoftW...er.exe
windows10-2004-x64
7MicrosoftW...ew.exe
windows7-x64
8MicrosoftW...ew.exe
windows10-2004-x64
8MicrosoftW...le.exe
windows7-x64
3MicrosoftW...le.exe
windows10-2004-x64
7MicrosoftW...od.exe
windows7-x64
1MicrosoftW...od.exe
windows10-2004-x64
1MicrosoftW...er.bat
windows7-x64
MicrosoftW...er.bat
windows10-2004-x64
MicrosoftW...32.exe
windows7-x64
1MicrosoftW...32.exe
windows10-2004-x64
1MicrosoftW...2s.exe
windows7-x64
4MicrosoftW...2s.exe
windows10-2004-x64
7MicrosoftW...le.vbs
windows7-x64
3MicrosoftW...le.vbs
windows10-2004-x64
7MicrosoftW...ec.vbs
windows7-x64
1MicrosoftW...ec.vbs
windows10-2004-x64
1MicrosoftW...en.vbs
windows7-x64
3MicrosoftW...en.vbs
windows10-2004-x64
7Analysis
- max time kernel
118s - max time network
125s - platform
windows7_x64 - resource
win7-20240221-en - resource tags
arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system - submitted
02/03/2024, 23:24
Static task
static1
Behavioral task
behavioral1
Sample
MicrosoftWindowsServicesEtc/AppKill.bat
Resource
win7-20240221-en
windows7-x64
Behavioral task
behavioral2
Sample
MicrosoftWindowsServicesEtc/AppKill.bat
Resource
win10v2004-20240226-en
windows10-2004-x64
Behavioral task
behavioral3
Sample
MicrosoftWindowsServicesEtc/CallFunc.vbs
Resource
win7-20240221-en
windows7-x64
Behavioral task
behavioral4
Sample
MicrosoftWindowsServicesEtc/CallFunc.vbs
Resource
win10v2004-20240226-en
windows10-2004-x64
Behavioral task
behavioral5
Sample
MicrosoftWindowsServicesEtc/DgzRun.vbs
Resource
win7-20240221-en
windows7-x64
Behavioral task
behavioral6
Sample
MicrosoftWindowsServicesEtc/DgzRun.vbs
Resource
win10v2004-20240226-en
windows10-2004-x64
Behavioral task
behavioral7
Sample
MicrosoftWindowsServicesEtc/GetReady.exe
Resource
win7-20240221-en
windows7-x64
Behavioral task
behavioral8
Sample
MicrosoftWindowsServicesEtc/GetReady.exe
Resource
win10v2004-20240226-en
windows10-2004-x64
Behavioral task
behavioral9
Sample
MicrosoftWindowsServicesEtc/Major.exe
Resource
win7-20240221-en
windows7-x64
Behavioral task
behavioral10
Sample
MicrosoftWindowsServicesEtc/Major.exe
Resource
win10v2004-20240226-en
windows10-2004-x64
Behavioral task
behavioral11
Sample
MicrosoftWindowsServicesEtc/NotMuch.exe
Resource
win7-20240215-en
windows7-x64
Behavioral task
behavioral12
Sample
MicrosoftWindowsServicesEtc/NotMuch.exe
Resource
win10v2004-20240226-en
windows10-2004-x64
Behavioral task
behavioral13
Sample
MicrosoftWindowsServicesEtc/RuntimeChecker.exe
Resource
win7-20240221-en
windows7-x64
Behavioral task
behavioral14
Sample
MicrosoftWindowsServicesEtc/RuntimeChecker.exe
Resource
win10v2004-20240226-en
windows10-2004-x64
Behavioral task
behavioral15
Sample
MicrosoftWindowsServicesEtc/WinScrew.exe
Resource
win7-20240215-en
windows7-x64
Behavioral task
behavioral16
Sample
MicrosoftWindowsServicesEtc/WinScrew.exe
Resource
win10v2004-20240226-en
windows10-2004-x64
Behavioral task
behavioral17
Sample
MicrosoftWindowsServicesEtc/breakrule.exe
Resource
win7-20240220-en
windows7-x64
Behavioral task
behavioral18
Sample
MicrosoftWindowsServicesEtc/breakrule.exe
Resource
win10v2004-20240226-en
windows10-2004-x64
Behavioral task
behavioral19
Sample
MicrosoftWindowsServicesEtc/bsod.exe
Resource
win7-20240221-en
windows7-x64
Behavioral task
behavioral20
Sample
MicrosoftWindowsServicesEtc/bsod.exe
Resource
win10v2004-20240226-en
windows10-2004-x64
Behavioral task
behavioral21
Sample
MicrosoftWindowsServicesEtc/checker.bat
Resource
win7-20240221-en
windows7-x64
Behavioral task
behavioral22
Sample
MicrosoftWindowsServicesEtc/checker.bat
Resource
win10v2004-20240226-en
windows10-2004-x64
Behavioral task
behavioral23
Sample
MicrosoftWindowsServicesEtc/data/eula32.exe
Resource
win7-20240221-en
windows7-x64
Behavioral task
behavioral24
Sample
MicrosoftWindowsServicesEtc/data/eula32.exe
Resource
win10v2004-20240226-en
windows10-2004-x64
Behavioral task
behavioral25
Sample
MicrosoftWindowsServicesEtc/data/runner32s.exe
Resource
win7-20240221-en
windows7-x64
Behavioral task
behavioral26
Sample
MicrosoftWindowsServicesEtc/data/runner32s.exe
Resource
win10v2004-20240226-en
windows10-2004-x64
Behavioral task
behavioral27
Sample
MicrosoftWindowsServicesEtc/example.vbs
Resource
win7-20240221-en
windows7-x64
Behavioral task
behavioral28
Sample
MicrosoftWindowsServicesEtc/example.vbs
Resource
win10v2004-20240226-en
windows10-2004-x64
Behavioral task
behavioral29
Sample
MicrosoftWindowsServicesEtc/fexec.vbs
Resource
win7-20240221-en
windows7-x64
Behavioral task
behavioral30
Sample
MicrosoftWindowsServicesEtc/fexec.vbs
Resource
win10v2004-20240226-en
windows10-2004-x64
Behavioral task
behavioral31
Sample
MicrosoftWindowsServicesEtc/healgen.vbs
Resource
win7-20240220-en
windows7-x64
Behavioral task
behavioral32
Sample
MicrosoftWindowsServicesEtc/healgen.vbs
Resource
win10v2004-20240226-en
windows10-2004-x64
General
- Target MicrosoftWindowsServicesEtc/AppKill.bat
- Size 671B
- Sample240302-3d17dsag33
- SHA256 5549670ef8837c6e3c4e496c1ea2063670618249d4151dea4d07d48ab456690c
- MD5 d4e987817d2e5d6ed2c12633d6f11101
- SHA1 3f38430a028f9e3cb66c152e302b3586512dd9c4
- SHA512 b84fef88f0128b46f1e2f9c5dff2cb620ee885bed6c90dcf4a5dc51c77bea492c92b8084d8dc8b4277b47b2493a2d9d3f348c6e229bf3da9041ef90e0fd8b6c4
- MD5 SHA1 SHA512
Malware Config
Signatures
- Kills process with taskkill 22 IoCs
pid Process 2776 taskkill.exe 1712 taskkill.exe 2744 taskkill.exe 1204 taskkill.exe 1072 taskkill.exe 2528 taskkill.exe 800 taskkill.exe 2644 taskkill.exe 1180 taskkill.exe 2708 taskkill.exe 2604 taskkill.exe 2568 taskkill.exe 2588 taskkill.exe 2868 taskkill.exe 2412 taskkill.exe 2652 taskkill.exe 2104 taskkill.exe 2276 taskkill.exe 1532 taskkill.exe 2884 taskkill.exe 1916 taskkill.exe 2392 taskkill.exe - Suspicious use of AdjustPrivilegeToken 22 IoCs
description pid Process Token: SeDebugPrivilege 2776 taskkill.exe Token: SeDebugPrivilege 2644 taskkill.exe Token: SeDebugPrivilege 1180 taskkill.exe Token: SeDebugPrivilege 800 taskkill.exe Token: SeDebugPrivilege 2528 taskkill.exe Token: SeDebugPrivilege 2652 taskkill.exe Token: SeDebugPrivilege 2392 taskkill.exe Token: SeDebugPrivilege 2412 taskkill.exe Token: SeDebugPrivilege 2868 taskkill.exe Token: SeDebugPrivilege 2884 taskkill.exe Token: SeDebugPrivilege 1072 taskkill.exe Token: SeDebugPrivilege 2588 taskkill.exe Token: SeDebugPrivilege 2568 taskkill.exe Token: SeDebugPrivilege 2604 taskkill.exe Token: SeDebugPrivilege 2708 taskkill.exe Token: SeDebugPrivilege 1204 taskkill.exe Token: SeDebugPrivilege 2744 taskkill.exe Token: SeDebugPrivilege 1532 taskkill.exe Token: SeDebugPrivilege 1916 taskkill.exe Token: SeDebugPrivilege 2276 taskkill.exe Token: SeDebugPrivilege 2104 taskkill.exe Token: SeDebugPrivilege 1712 taskkill.exe - Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2128 wrote to memory of 2776 2128 cmd.exe 29 PID 2128 wrote to memory of 2776 2128 cmd.exe 29 PID 2128 wrote to memory of 2776 2128 cmd.exe 29 PID 2128 wrote to memory of 2644 2128 cmd.exe 31 PID 2128 wrote to memory of 2644 2128 cmd.exe 31 PID 2128 wrote to memory of 2644 2128 cmd.exe 31 PID 2128 wrote to memory of 1180 2128 cmd.exe 32 PID 2128 wrote to memory of 1180 2128 cmd.exe 32 PID 2128 wrote to memory of 1180 2128 cmd.exe 32 PID 2128 wrote to memory of 800 2128 cmd.exe 33 PID 2128 wrote to memory of 800 2128 cmd.exe 33 PID 2128 wrote to memory of 800 2128 cmd.exe 33 PID 2128 wrote to memory of 2528 2128 cmd.exe 34 PID 2128 wrote to memory of 2528 2128 cmd.exe 34 PID 2128 wrote to memory of 2528 2128 cmd.exe 34 PID 2128 wrote to memory of 2652 2128 cmd.exe 35 PID 2128 wrote to memory of 2652 2128 cmd.exe 35 PID 2128 wrote to memory of 2652 2128 cmd.exe 35 PID 2128 wrote to memory of 2392 2128 cmd.exe 36 PID 2128 wrote to memory of 2392 2128 cmd.exe 36 PID 2128 wrote to memory of 2392 2128 cmd.exe 36 PID 2128 wrote to memory of 2412 2128 cmd.exe 37 PID 2128 wrote to memory of 2412 2128 cmd.exe 37 PID 2128 wrote to memory of 2412 2128 cmd.exe 37 PID 2128 wrote to memory of 2868 2128 cmd.exe 38 PID 2128 wrote to memory of 2868 2128 cmd.exe 38 PID 2128 wrote to memory of 2868 2128 cmd.exe 38 PID 2128 wrote to memory of 2884 2128 cmd.exe 39 PID 2128 wrote to memory of 2884 2128 cmd.exe 39 PID 2128 wrote to memory of 2884 2128 cmd.exe 39 PID 2128 wrote to memory of 1072 2128 cmd.exe 40 PID 2128 wrote to memory of 1072 2128 cmd.exe 40 PID 2128 wrote to memory of 1072 2128 cmd.exe 40 PID 2128 wrote to memory of 2588 2128 cmd.exe 41 PID 2128 wrote to memory of 2588 2128 cmd.exe 41 PID 2128 wrote to memory of 2588 2128 cmd.exe 41 PID 2128 wrote to memory of 2568 2128 cmd.exe 42 PID 2128 wrote to memory of 2568 2128 cmd.exe 42 PID 2128 wrote to memory of 2568 2128 cmd.exe 42 PID 2128 wrote to memory of 2604 2128 cmd.exe 43 PID 2128 wrote to memory of 2604 2128 cmd.exe 43 PID 2128 wrote to memory of 2604 2128 cmd.exe 43 PID 2128 wrote to memory of 2708 2128 cmd.exe 44 PID 2128 wrote to memory of 2708 2128 cmd.exe 44 PID 2128 wrote to memory of 2708 2128 cmd.exe 44 PID 2128 wrote to memory of 1204 2128 cmd.exe 45 PID 2128 wrote to memory of 1204 2128 cmd.exe 45 PID 2128 wrote to memory of 1204 2128 cmd.exe 45 PID 2128 wrote to memory of 2744 2128 cmd.exe 46 PID 2128 wrote to memory of 2744 2128 cmd.exe 46 PID 2128 wrote to memory of 2744 2128 cmd.exe 46 PID 2128 wrote to memory of 1532 2128 cmd.exe 47 PID 2128 wrote to memory of 1532 2128 cmd.exe 47 PID 2128 wrote to memory of 1532 2128 cmd.exe 47 PID 2128 wrote to memory of 1916 2128 cmd.exe 48 PID 2128 wrote to memory of 1916 2128 cmd.exe 48 PID 2128 wrote to memory of 1916 2128 cmd.exe 48 PID 2128 wrote to memory of 2276 2128 cmd.exe 49 PID 2128 wrote to memory of 2276 2128 cmd.exe 49 PID 2128 wrote to memory of 2276 2128 cmd.exe 49 PID 2128 wrote to memory of 2104 2128 cmd.exe 50 PID 2128 wrote to memory of 2104 2128 cmd.exe 50 PID 2128 wrote to memory of 2104 2128 cmd.exe 50 PID 2128 wrote to memory of 1712 2128 cmd.exe 51
Processes
-
C:\Windows\system32\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\MicrosoftWindowsServicesEtc\AppKill.bat"1⤵
- Suspicious use of WriteProcessMemory
PID:2128 -
C:\Windows\system32\taskkill.exetaskkill /f /im chrome.exe2⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:2776
-
-
C:\Windows\system32\taskkill.exetaskkill /f /im opera.exe2⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:2644
-
-
C:\Windows\system32\taskkill.exetaskkill /f /im mspaint.exe2⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:1180
-
-
C:\Windows\system32\taskkill.exetaskkill /f /im calc.exe2⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:800
-
-
C:\Windows\system32\taskkill.exetaskkill /f /im firefox.exe2⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:2528
-
-
C:\Windows\system32\taskkill.exetaskkill /f /im ProcessExplorer.exe2⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:2652
-
-
C:\Windows\system32\taskkill.exetaskkill /f /im ProcessHacker.exe2⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:2392
-
-
C:\Windows\system32\taskkill.exetaskkill /f /im iexplore.exe2⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:2412
-
-
C:\Windows\system32\taskkill.exetaskkill /f /im notepad.exe2⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:2868
-
-
C:\Windows\system32\taskkill.exetaskkill /f /im yandex.exe2⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:2884
-
-
C:\Windows\system32\taskkill.exetaskkill /f /im browser.exe2⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:1072
-
-
C:\Windows\system32\taskkill.exetaskkill /f /im eset.exe2⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:2588
-
-
C:\Windows\system32\taskkill.exetaskkill /f /im protogent.exe2⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:2568
-
-
C:\Windows\system32\taskkill.exetaskkill /f /im regedit2⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:2604
-
-
C:\Windows\system32\taskkill.exetaskkill /f /im rundll32.exe2⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:2708
-
-
C:\Windows\system32\taskkill.exetaskkill /f /im rundll.exe2⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:1204
-
-
C:\Windows\system32\taskkill.exetaskkill /f /im dllhost.exe2⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:2744
-
-
C:\Windows\system32\taskkill.exetaskkill /f /im superaltf4.exe2⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:1532
-
-
C:\Windows\system32\taskkill.exetaskkill /f /im msedge.exe2⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:1916
-
-
C:\Windows\system32\taskkill.exetaskkill /f /im microsoftedge.exe2⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:2276
-
-
C:\Windows\system32\taskkill.exetaskkill /f /im mrsmjrgui.exe2⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:2104
-
-
C:\Windows\system32\taskkill.exetaskkill /f /im yandex.exe2⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:1712
-