Overview
overview
8Static
static
3MicrosoftW...ll.bat
windows7-x64
1MicrosoftW...ll.bat
windows10-2004-x64
1MicrosoftW...nc.vbs
windows7-x64
3MicrosoftW...nc.vbs
windows10-2004-x64
7MicrosoftW...un.vbs
windows7-x64
3MicrosoftW...un.vbs
windows10-2004-x64
7MicrosoftW...dy.exe
windows7-x64
8MicrosoftW...dy.exe
windows10-2004-x64
8MicrosoftW...or.exe
windows7-x64
3MicrosoftW...or.exe
windows10-2004-x64
7MicrosoftW...ch.exe
windows7-x64
1MicrosoftW...ch.exe
windows10-2004-x64
1MicrosoftW...er.exe
windows7-x64
3MicrosoftW...er.exe
windows10-2004-x64
7MicrosoftW...ew.exe
windows7-x64
8MicrosoftW...ew.exe
windows10-2004-x64
8MicrosoftW...le.exe
windows7-x64
3MicrosoftW...le.exe
windows10-2004-x64
7MicrosoftW...od.exe
windows7-x64
1MicrosoftW...od.exe
windows10-2004-x64
1MicrosoftW...er.bat
windows7-x64
MicrosoftW...er.bat
windows10-2004-x64
MicrosoftW...32.exe
windows7-x64
1MicrosoftW...32.exe
windows10-2004-x64
1MicrosoftW...2s.exe
windows7-x64
4MicrosoftW...2s.exe
windows10-2004-x64
7MicrosoftW...le.vbs
windows7-x64
3MicrosoftW...le.vbs
windows10-2004-x64
7MicrosoftW...ec.vbs
windows7-x64
1MicrosoftW...ec.vbs
windows10-2004-x64
1MicrosoftW...en.vbs
windows7-x64
3MicrosoftW...en.vbs
windows10-2004-x64
7Analysis
-
max time kernel
118s -
max time network
125s -
platform
windows7_x64 -
resource
win7-20240221-en -
resource tags
arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system -
submitted
02-03-2024 23:24
Static task
static1
Behavioral task
behavioral1
Sample
MicrosoftWindowsServicesEtc/AppKill.bat
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
MicrosoftWindowsServicesEtc/AppKill.bat
Resource
win10v2004-20240226-en
Behavioral task
behavioral3
Sample
MicrosoftWindowsServicesEtc/CallFunc.vbs
Resource
win7-20240221-en
Behavioral task
behavioral4
Sample
MicrosoftWindowsServicesEtc/CallFunc.vbs
Resource
win10v2004-20240226-en
Behavioral task
behavioral5
Sample
MicrosoftWindowsServicesEtc/DgzRun.vbs
Resource
win7-20240221-en
Behavioral task
behavioral6
Sample
MicrosoftWindowsServicesEtc/DgzRun.vbs
Resource
win10v2004-20240226-en
Behavioral task
behavioral7
Sample
MicrosoftWindowsServicesEtc/GetReady.exe
Resource
win7-20240221-en
Behavioral task
behavioral8
Sample
MicrosoftWindowsServicesEtc/GetReady.exe
Resource
win10v2004-20240226-en
Behavioral task
behavioral9
Sample
MicrosoftWindowsServicesEtc/Major.exe
Resource
win7-20240221-en
Behavioral task
behavioral10
Sample
MicrosoftWindowsServicesEtc/Major.exe
Resource
win10v2004-20240226-en
Behavioral task
behavioral11
Sample
MicrosoftWindowsServicesEtc/NotMuch.exe
Resource
win7-20240215-en
Behavioral task
behavioral12
Sample
MicrosoftWindowsServicesEtc/NotMuch.exe
Resource
win10v2004-20240226-en
Behavioral task
behavioral13
Sample
MicrosoftWindowsServicesEtc/RuntimeChecker.exe
Resource
win7-20240221-en
Behavioral task
behavioral14
Sample
MicrosoftWindowsServicesEtc/RuntimeChecker.exe
Resource
win10v2004-20240226-en
Behavioral task
behavioral15
Sample
MicrosoftWindowsServicesEtc/WinScrew.exe
Resource
win7-20240215-en
Behavioral task
behavioral16
Sample
MicrosoftWindowsServicesEtc/WinScrew.exe
Resource
win10v2004-20240226-en
Behavioral task
behavioral17
Sample
MicrosoftWindowsServicesEtc/breakrule.exe
Resource
win7-20240220-en
Behavioral task
behavioral18
Sample
MicrosoftWindowsServicesEtc/breakrule.exe
Resource
win10v2004-20240226-en
Behavioral task
behavioral19
Sample
MicrosoftWindowsServicesEtc/bsod.exe
Resource
win7-20240221-en
Behavioral task
behavioral20
Sample
MicrosoftWindowsServicesEtc/bsod.exe
Resource
win10v2004-20240226-en
Behavioral task
behavioral21
Sample
MicrosoftWindowsServicesEtc/checker.bat
Resource
win7-20240221-en
Behavioral task
behavioral22
Sample
MicrosoftWindowsServicesEtc/checker.bat
Resource
win10v2004-20240226-en
Behavioral task
behavioral23
Sample
MicrosoftWindowsServicesEtc/data/eula32.exe
Resource
win7-20240221-en
Behavioral task
behavioral24
Sample
MicrosoftWindowsServicesEtc/data/eula32.exe
Resource
win10v2004-20240226-en
Behavioral task
behavioral25
Sample
MicrosoftWindowsServicesEtc/data/runner32s.exe
Resource
win7-20240221-en
Behavioral task
behavioral26
Sample
MicrosoftWindowsServicesEtc/data/runner32s.exe
Resource
win10v2004-20240226-en
Behavioral task
behavioral27
Sample
MicrosoftWindowsServicesEtc/example.vbs
Resource
win7-20240221-en
Behavioral task
behavioral28
Sample
MicrosoftWindowsServicesEtc/example.vbs
Resource
win10v2004-20240226-en
Behavioral task
behavioral29
Sample
MicrosoftWindowsServicesEtc/fexec.vbs
Resource
win7-20240221-en
Behavioral task
behavioral30
Sample
MicrosoftWindowsServicesEtc/fexec.vbs
Resource
win10v2004-20240226-en
Behavioral task
behavioral31
Sample
MicrosoftWindowsServicesEtc/healgen.vbs
Resource
win7-20240220-en
Behavioral task
behavioral32
Sample
MicrosoftWindowsServicesEtc/healgen.vbs
Resource
win10v2004-20240226-en
General
-
Target
MicrosoftWindowsServicesEtc/AppKill.bat
-
Size
671B
-
MD5
d4e987817d2e5d6ed2c12633d6f11101
-
SHA1
3f38430a028f9e3cb66c152e302b3586512dd9c4
-
SHA256
5549670ef8837c6e3c4e496c1ea2063670618249d4151dea4d07d48ab456690c
-
SHA512
b84fef88f0128b46f1e2f9c5dff2cb620ee885bed6c90dcf4a5dc51c77bea492c92b8084d8dc8b4277b47b2493a2d9d3f348c6e229bf3da9041ef90e0fd8b6c4
Malware Config
Signatures
-
Kills process with taskkill 22 IoCs
Processes:
taskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exepid process 2776 taskkill.exe 1712 taskkill.exe 2744 taskkill.exe 1204 taskkill.exe 1072 taskkill.exe 2528 taskkill.exe 800 taskkill.exe 2644 taskkill.exe 1180 taskkill.exe 2708 taskkill.exe 2604 taskkill.exe 2568 taskkill.exe 2588 taskkill.exe 2868 taskkill.exe 2412 taskkill.exe 2652 taskkill.exe 2104 taskkill.exe 2276 taskkill.exe 1532 taskkill.exe 2884 taskkill.exe 1916 taskkill.exe 2392 taskkill.exe -
Suspicious use of AdjustPrivilegeToken 22 IoCs
Processes:
taskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exedescription pid process Token: SeDebugPrivilege 2776 taskkill.exe Token: SeDebugPrivilege 2644 taskkill.exe Token: SeDebugPrivilege 1180 taskkill.exe Token: SeDebugPrivilege 800 taskkill.exe Token: SeDebugPrivilege 2528 taskkill.exe Token: SeDebugPrivilege 2652 taskkill.exe Token: SeDebugPrivilege 2392 taskkill.exe Token: SeDebugPrivilege 2412 taskkill.exe Token: SeDebugPrivilege 2868 taskkill.exe Token: SeDebugPrivilege 2884 taskkill.exe Token: SeDebugPrivilege 1072 taskkill.exe Token: SeDebugPrivilege 2588 taskkill.exe Token: SeDebugPrivilege 2568 taskkill.exe Token: SeDebugPrivilege 2604 taskkill.exe Token: SeDebugPrivilege 2708 taskkill.exe Token: SeDebugPrivilege 1204 taskkill.exe Token: SeDebugPrivilege 2744 taskkill.exe Token: SeDebugPrivilege 1532 taskkill.exe Token: SeDebugPrivilege 1916 taskkill.exe Token: SeDebugPrivilege 2276 taskkill.exe Token: SeDebugPrivilege 2104 taskkill.exe Token: SeDebugPrivilege 1712 taskkill.exe -
Suspicious use of WriteProcessMemory 64 IoCs
Processes:
cmd.exedescription pid process target process PID 2128 wrote to memory of 2776 2128 cmd.exe taskkill.exe PID 2128 wrote to memory of 2776 2128 cmd.exe taskkill.exe PID 2128 wrote to memory of 2776 2128 cmd.exe taskkill.exe PID 2128 wrote to memory of 2644 2128 cmd.exe taskkill.exe PID 2128 wrote to memory of 2644 2128 cmd.exe taskkill.exe PID 2128 wrote to memory of 2644 2128 cmd.exe taskkill.exe PID 2128 wrote to memory of 1180 2128 cmd.exe taskkill.exe PID 2128 wrote to memory of 1180 2128 cmd.exe taskkill.exe PID 2128 wrote to memory of 1180 2128 cmd.exe taskkill.exe PID 2128 wrote to memory of 800 2128 cmd.exe taskkill.exe PID 2128 wrote to memory of 800 2128 cmd.exe taskkill.exe PID 2128 wrote to memory of 800 2128 cmd.exe taskkill.exe PID 2128 wrote to memory of 2528 2128 cmd.exe taskkill.exe PID 2128 wrote to memory of 2528 2128 cmd.exe taskkill.exe PID 2128 wrote to memory of 2528 2128 cmd.exe taskkill.exe PID 2128 wrote to memory of 2652 2128 cmd.exe taskkill.exe PID 2128 wrote to memory of 2652 2128 cmd.exe taskkill.exe PID 2128 wrote to memory of 2652 2128 cmd.exe taskkill.exe PID 2128 wrote to memory of 2392 2128 cmd.exe taskkill.exe PID 2128 wrote to memory of 2392 2128 cmd.exe taskkill.exe PID 2128 wrote to memory of 2392 2128 cmd.exe taskkill.exe PID 2128 wrote to memory of 2412 2128 cmd.exe taskkill.exe PID 2128 wrote to memory of 2412 2128 cmd.exe taskkill.exe PID 2128 wrote to memory of 2412 2128 cmd.exe taskkill.exe PID 2128 wrote to memory of 2868 2128 cmd.exe taskkill.exe PID 2128 wrote to memory of 2868 2128 cmd.exe taskkill.exe PID 2128 wrote to memory of 2868 2128 cmd.exe taskkill.exe PID 2128 wrote to memory of 2884 2128 cmd.exe taskkill.exe PID 2128 wrote to memory of 2884 2128 cmd.exe taskkill.exe PID 2128 wrote to memory of 2884 2128 cmd.exe taskkill.exe PID 2128 wrote to memory of 1072 2128 cmd.exe taskkill.exe PID 2128 wrote to memory of 1072 2128 cmd.exe taskkill.exe PID 2128 wrote to memory of 1072 2128 cmd.exe taskkill.exe PID 2128 wrote to memory of 2588 2128 cmd.exe taskkill.exe PID 2128 wrote to memory of 2588 2128 cmd.exe taskkill.exe PID 2128 wrote to memory of 2588 2128 cmd.exe taskkill.exe PID 2128 wrote to memory of 2568 2128 cmd.exe taskkill.exe PID 2128 wrote to memory of 2568 2128 cmd.exe taskkill.exe PID 2128 wrote to memory of 2568 2128 cmd.exe taskkill.exe PID 2128 wrote to memory of 2604 2128 cmd.exe taskkill.exe PID 2128 wrote to memory of 2604 2128 cmd.exe taskkill.exe PID 2128 wrote to memory of 2604 2128 cmd.exe taskkill.exe PID 2128 wrote to memory of 2708 2128 cmd.exe taskkill.exe PID 2128 wrote to memory of 2708 2128 cmd.exe taskkill.exe PID 2128 wrote to memory of 2708 2128 cmd.exe taskkill.exe PID 2128 wrote to memory of 1204 2128 cmd.exe taskkill.exe PID 2128 wrote to memory of 1204 2128 cmd.exe taskkill.exe PID 2128 wrote to memory of 1204 2128 cmd.exe taskkill.exe PID 2128 wrote to memory of 2744 2128 cmd.exe taskkill.exe PID 2128 wrote to memory of 2744 2128 cmd.exe taskkill.exe PID 2128 wrote to memory of 2744 2128 cmd.exe taskkill.exe PID 2128 wrote to memory of 1532 2128 cmd.exe taskkill.exe PID 2128 wrote to memory of 1532 2128 cmd.exe taskkill.exe PID 2128 wrote to memory of 1532 2128 cmd.exe taskkill.exe PID 2128 wrote to memory of 1916 2128 cmd.exe taskkill.exe PID 2128 wrote to memory of 1916 2128 cmd.exe taskkill.exe PID 2128 wrote to memory of 1916 2128 cmd.exe taskkill.exe PID 2128 wrote to memory of 2276 2128 cmd.exe taskkill.exe PID 2128 wrote to memory of 2276 2128 cmd.exe taskkill.exe PID 2128 wrote to memory of 2276 2128 cmd.exe taskkill.exe PID 2128 wrote to memory of 2104 2128 cmd.exe taskkill.exe PID 2128 wrote to memory of 2104 2128 cmd.exe taskkill.exe PID 2128 wrote to memory of 2104 2128 cmd.exe taskkill.exe PID 2128 wrote to memory of 1712 2128 cmd.exe taskkill.exe
Processes
-
C:\Windows\system32\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\MicrosoftWindowsServicesEtc\AppKill.bat"1⤵
- Suspicious use of WriteProcessMemory
PID:2128 -
C:\Windows\system32\taskkill.exetaskkill /f /im chrome.exe2⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:2776
-
-
C:\Windows\system32\taskkill.exetaskkill /f /im opera.exe2⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:2644
-
-
C:\Windows\system32\taskkill.exetaskkill /f /im mspaint.exe2⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:1180
-
-
C:\Windows\system32\taskkill.exetaskkill /f /im calc.exe2⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:800
-
-
C:\Windows\system32\taskkill.exetaskkill /f /im firefox.exe2⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:2528
-
-
C:\Windows\system32\taskkill.exetaskkill /f /im ProcessExplorer.exe2⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:2652
-
-
C:\Windows\system32\taskkill.exetaskkill /f /im ProcessHacker.exe2⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:2392
-
-
C:\Windows\system32\taskkill.exetaskkill /f /im iexplore.exe2⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:2412
-
-
C:\Windows\system32\taskkill.exetaskkill /f /im notepad.exe2⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:2868
-
-
C:\Windows\system32\taskkill.exetaskkill /f /im yandex.exe2⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:2884
-
-
C:\Windows\system32\taskkill.exetaskkill /f /im browser.exe2⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:1072
-
-
C:\Windows\system32\taskkill.exetaskkill /f /im eset.exe2⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:2588
-
-
C:\Windows\system32\taskkill.exetaskkill /f /im protogent.exe2⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:2568
-
-
C:\Windows\system32\taskkill.exetaskkill /f /im regedit2⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:2604
-
-
C:\Windows\system32\taskkill.exetaskkill /f /im rundll32.exe2⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:2708
-
-
C:\Windows\system32\taskkill.exetaskkill /f /im rundll.exe2⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:1204
-
-
C:\Windows\system32\taskkill.exetaskkill /f /im dllhost.exe2⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:2744
-
-
C:\Windows\system32\taskkill.exetaskkill /f /im superaltf4.exe2⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:1532
-
-
C:\Windows\system32\taskkill.exetaskkill /f /im msedge.exe2⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:1916
-
-
C:\Windows\system32\taskkill.exetaskkill /f /im microsoftedge.exe2⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:2276
-
-
C:\Windows\system32\taskkill.exetaskkill /f /im mrsmjrgui.exe2⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:2104
-
-
C:\Windows\system32\taskkill.exetaskkill /f /im yandex.exe2⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:1712
-