Overview
overview
8Static
static
3MicrosoftW...ll.bat
windows7-x64
1MicrosoftW...ll.bat
windows10-2004-x64
1MicrosoftW...nc.vbs
windows7-x64
3MicrosoftW...nc.vbs
windows10-2004-x64
7MicrosoftW...un.vbs
windows7-x64
3MicrosoftW...un.vbs
windows10-2004-x64
7MicrosoftW...dy.exe
windows7-x64
8MicrosoftW...dy.exe
windows10-2004-x64
8MicrosoftW...or.exe
windows7-x64
3MicrosoftW...or.exe
windows10-2004-x64
7MicrosoftW...ch.exe
windows7-x64
1MicrosoftW...ch.exe
windows10-2004-x64
1MicrosoftW...er.exe
windows7-x64
3MicrosoftW...er.exe
windows10-2004-x64
7MicrosoftW...ew.exe
windows7-x64
8MicrosoftW...ew.exe
windows10-2004-x64
8MicrosoftW...le.exe
windows7-x64
3MicrosoftW...le.exe
windows10-2004-x64
7MicrosoftW...od.exe
windows7-x64
1MicrosoftW...od.exe
windows10-2004-x64
1MicrosoftW...er.bat
windows7-x64
MicrosoftW...er.bat
windows10-2004-x64
MicrosoftW...32.exe
windows7-x64
1MicrosoftW...32.exe
windows10-2004-x64
1MicrosoftW...2s.exe
windows7-x64
4MicrosoftW...2s.exe
windows10-2004-x64
7MicrosoftW...le.vbs
windows7-x64
3MicrosoftW...le.vbs
windows10-2004-x64
7MicrosoftW...ec.vbs
windows7-x64
1MicrosoftW...ec.vbs
windows10-2004-x64
1MicrosoftW...en.vbs
windows7-x64
3MicrosoftW...en.vbs
windows10-2004-x64
7Analysis
-
max time kernel
147s -
max time network
159s -
platform
windows10-2004_x64 -
resource
win10v2004-20240226-en -
resource tags
arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system -
submitted
02-03-2024 23:24
Static task
static1
Behavioral task
behavioral1
Sample
MicrosoftWindowsServicesEtc/AppKill.bat
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
MicrosoftWindowsServicesEtc/AppKill.bat
Resource
win10v2004-20240226-en
Behavioral task
behavioral3
Sample
MicrosoftWindowsServicesEtc/CallFunc.vbs
Resource
win7-20240221-en
Behavioral task
behavioral4
Sample
MicrosoftWindowsServicesEtc/CallFunc.vbs
Resource
win10v2004-20240226-en
Behavioral task
behavioral5
Sample
MicrosoftWindowsServicesEtc/DgzRun.vbs
Resource
win7-20240221-en
Behavioral task
behavioral6
Sample
MicrosoftWindowsServicesEtc/DgzRun.vbs
Resource
win10v2004-20240226-en
Behavioral task
behavioral7
Sample
MicrosoftWindowsServicesEtc/GetReady.exe
Resource
win7-20240221-en
Behavioral task
behavioral8
Sample
MicrosoftWindowsServicesEtc/GetReady.exe
Resource
win10v2004-20240226-en
Behavioral task
behavioral9
Sample
MicrosoftWindowsServicesEtc/Major.exe
Resource
win7-20240221-en
Behavioral task
behavioral10
Sample
MicrosoftWindowsServicesEtc/Major.exe
Resource
win10v2004-20240226-en
Behavioral task
behavioral11
Sample
MicrosoftWindowsServicesEtc/NotMuch.exe
Resource
win7-20240215-en
Behavioral task
behavioral12
Sample
MicrosoftWindowsServicesEtc/NotMuch.exe
Resource
win10v2004-20240226-en
Behavioral task
behavioral13
Sample
MicrosoftWindowsServicesEtc/RuntimeChecker.exe
Resource
win7-20240221-en
Behavioral task
behavioral14
Sample
MicrosoftWindowsServicesEtc/RuntimeChecker.exe
Resource
win10v2004-20240226-en
Behavioral task
behavioral15
Sample
MicrosoftWindowsServicesEtc/WinScrew.exe
Resource
win7-20240215-en
Behavioral task
behavioral16
Sample
MicrosoftWindowsServicesEtc/WinScrew.exe
Resource
win10v2004-20240226-en
Behavioral task
behavioral17
Sample
MicrosoftWindowsServicesEtc/breakrule.exe
Resource
win7-20240220-en
Behavioral task
behavioral18
Sample
MicrosoftWindowsServicesEtc/breakrule.exe
Resource
win10v2004-20240226-en
Behavioral task
behavioral19
Sample
MicrosoftWindowsServicesEtc/bsod.exe
Resource
win7-20240221-en
Behavioral task
behavioral20
Sample
MicrosoftWindowsServicesEtc/bsod.exe
Resource
win10v2004-20240226-en
Behavioral task
behavioral21
Sample
MicrosoftWindowsServicesEtc/checker.bat
Resource
win7-20240221-en
Behavioral task
behavioral22
Sample
MicrosoftWindowsServicesEtc/checker.bat
Resource
win10v2004-20240226-en
Behavioral task
behavioral23
Sample
MicrosoftWindowsServicesEtc/data/eula32.exe
Resource
win7-20240221-en
Behavioral task
behavioral24
Sample
MicrosoftWindowsServicesEtc/data/eula32.exe
Resource
win10v2004-20240226-en
Behavioral task
behavioral25
Sample
MicrosoftWindowsServicesEtc/data/runner32s.exe
Resource
win7-20240221-en
Behavioral task
behavioral26
Sample
MicrosoftWindowsServicesEtc/data/runner32s.exe
Resource
win10v2004-20240226-en
Behavioral task
behavioral27
Sample
MicrosoftWindowsServicesEtc/example.vbs
Resource
win7-20240221-en
Behavioral task
behavioral28
Sample
MicrosoftWindowsServicesEtc/example.vbs
Resource
win10v2004-20240226-en
Behavioral task
behavioral29
Sample
MicrosoftWindowsServicesEtc/fexec.vbs
Resource
win7-20240221-en
Behavioral task
behavioral30
Sample
MicrosoftWindowsServicesEtc/fexec.vbs
Resource
win10v2004-20240226-en
Behavioral task
behavioral31
Sample
MicrosoftWindowsServicesEtc/healgen.vbs
Resource
win7-20240220-en
Behavioral task
behavioral32
Sample
MicrosoftWindowsServicesEtc/healgen.vbs
Resource
win10v2004-20240226-en
General
-
Target
MicrosoftWindowsServicesEtc/AppKill.bat
-
Size
671B
-
MD5
d4e987817d2e5d6ed2c12633d6f11101
-
SHA1
3f38430a028f9e3cb66c152e302b3586512dd9c4
-
SHA256
5549670ef8837c6e3c4e496c1ea2063670618249d4151dea4d07d48ab456690c
-
SHA512
b84fef88f0128b46f1e2f9c5dff2cb620ee885bed6c90dcf4a5dc51c77bea492c92b8084d8dc8b4277b47b2493a2d9d3f348c6e229bf3da9041ef90e0fd8b6c4
Malware Config
Signatures
-
Kills process with taskkill 22 IoCs
Processes:
taskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exepid process 4572 taskkill.exe 2460 taskkill.exe 3284 taskkill.exe 3852 taskkill.exe 4836 taskkill.exe 208 taskkill.exe 2088 taskkill.exe 2340 taskkill.exe 3580 taskkill.exe 4408 taskkill.exe 2112 taskkill.exe 4588 taskkill.exe 4796 taskkill.exe 716 taskkill.exe 3528 taskkill.exe 4768 taskkill.exe 3912 taskkill.exe 768 taskkill.exe 4076 taskkill.exe 1728 taskkill.exe 1816 taskkill.exe 1480 taskkill.exe -
Suspicious use of AdjustPrivilegeToken 22 IoCs
Processes:
taskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exedescription pid process Token: SeDebugPrivilege 3912 taskkill.exe Token: SeDebugPrivilege 768 taskkill.exe Token: SeDebugPrivilege 4408 taskkill.exe Token: SeDebugPrivilege 3284 taskkill.exe Token: SeDebugPrivilege 3852 taskkill.exe Token: SeDebugPrivilege 2112 taskkill.exe Token: SeDebugPrivilege 4076 taskkill.exe Token: SeDebugPrivilege 4588 taskkill.exe Token: SeDebugPrivilege 4836 taskkill.exe Token: SeDebugPrivilege 4572 taskkill.exe Token: SeDebugPrivilege 208 taskkill.exe Token: SeDebugPrivilege 2088 taskkill.exe Token: SeDebugPrivilege 2340 taskkill.exe Token: SeDebugPrivilege 1728 taskkill.exe Token: SeDebugPrivilege 4796 taskkill.exe Token: SeDebugPrivilege 716 taskkill.exe Token: SeDebugPrivilege 1816 taskkill.exe Token: SeDebugPrivilege 1480 taskkill.exe Token: SeDebugPrivilege 3580 taskkill.exe Token: SeDebugPrivilege 3528 taskkill.exe Token: SeDebugPrivilege 2460 taskkill.exe Token: SeDebugPrivilege 4768 taskkill.exe -
Suspicious use of WriteProcessMemory 44 IoCs
Processes:
cmd.exedescription pid process target process PID 4292 wrote to memory of 3912 4292 cmd.exe taskkill.exe PID 4292 wrote to memory of 3912 4292 cmd.exe taskkill.exe PID 4292 wrote to memory of 768 4292 cmd.exe taskkill.exe PID 4292 wrote to memory of 768 4292 cmd.exe taskkill.exe PID 4292 wrote to memory of 4408 4292 cmd.exe taskkill.exe PID 4292 wrote to memory of 4408 4292 cmd.exe taskkill.exe PID 4292 wrote to memory of 3284 4292 cmd.exe taskkill.exe PID 4292 wrote to memory of 3284 4292 cmd.exe taskkill.exe PID 4292 wrote to memory of 3852 4292 cmd.exe taskkill.exe PID 4292 wrote to memory of 3852 4292 cmd.exe taskkill.exe PID 4292 wrote to memory of 2112 4292 cmd.exe taskkill.exe PID 4292 wrote to memory of 2112 4292 cmd.exe taskkill.exe PID 4292 wrote to memory of 4076 4292 cmd.exe taskkill.exe PID 4292 wrote to memory of 4076 4292 cmd.exe taskkill.exe PID 4292 wrote to memory of 4588 4292 cmd.exe taskkill.exe PID 4292 wrote to memory of 4588 4292 cmd.exe taskkill.exe PID 4292 wrote to memory of 4836 4292 cmd.exe taskkill.exe PID 4292 wrote to memory of 4836 4292 cmd.exe taskkill.exe PID 4292 wrote to memory of 4572 4292 cmd.exe taskkill.exe PID 4292 wrote to memory of 4572 4292 cmd.exe taskkill.exe PID 4292 wrote to memory of 208 4292 cmd.exe taskkill.exe PID 4292 wrote to memory of 208 4292 cmd.exe taskkill.exe PID 4292 wrote to memory of 2088 4292 cmd.exe taskkill.exe PID 4292 wrote to memory of 2088 4292 cmd.exe taskkill.exe PID 4292 wrote to memory of 2340 4292 cmd.exe taskkill.exe PID 4292 wrote to memory of 2340 4292 cmd.exe taskkill.exe PID 4292 wrote to memory of 1728 4292 cmd.exe taskkill.exe PID 4292 wrote to memory of 1728 4292 cmd.exe taskkill.exe PID 4292 wrote to memory of 4796 4292 cmd.exe taskkill.exe PID 4292 wrote to memory of 4796 4292 cmd.exe taskkill.exe PID 4292 wrote to memory of 716 4292 cmd.exe taskkill.exe PID 4292 wrote to memory of 716 4292 cmd.exe taskkill.exe PID 4292 wrote to memory of 1816 4292 cmd.exe taskkill.exe PID 4292 wrote to memory of 1816 4292 cmd.exe taskkill.exe PID 4292 wrote to memory of 1480 4292 cmd.exe taskkill.exe PID 4292 wrote to memory of 1480 4292 cmd.exe taskkill.exe PID 4292 wrote to memory of 3580 4292 cmd.exe taskkill.exe PID 4292 wrote to memory of 3580 4292 cmd.exe taskkill.exe PID 4292 wrote to memory of 3528 4292 cmd.exe taskkill.exe PID 4292 wrote to memory of 3528 4292 cmd.exe taskkill.exe PID 4292 wrote to memory of 2460 4292 cmd.exe taskkill.exe PID 4292 wrote to memory of 2460 4292 cmd.exe taskkill.exe PID 4292 wrote to memory of 4768 4292 cmd.exe taskkill.exe PID 4292 wrote to memory of 4768 4292 cmd.exe taskkill.exe
Processes
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\MicrosoftWindowsServicesEtc\AppKill.bat"1⤵
- Suspicious use of WriteProcessMemory
PID:4292 -
C:\Windows\system32\taskkill.exetaskkill /f /im chrome.exe2⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:3912
-
-
C:\Windows\system32\taskkill.exetaskkill /f /im opera.exe2⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:768
-
-
C:\Windows\system32\taskkill.exetaskkill /f /im mspaint.exe2⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:4408
-
-
C:\Windows\system32\taskkill.exetaskkill /f /im calc.exe2⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:3284
-
-
C:\Windows\system32\taskkill.exetaskkill /f /im firefox.exe2⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:3852
-
-
C:\Windows\system32\taskkill.exetaskkill /f /im ProcessExplorer.exe2⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:2112
-
-
C:\Windows\system32\taskkill.exetaskkill /f /im ProcessHacker.exe2⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:4076
-
-
C:\Windows\system32\taskkill.exetaskkill /f /im iexplore.exe2⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:4588
-
-
C:\Windows\system32\taskkill.exetaskkill /f /im notepad.exe2⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:4836
-
-
C:\Windows\system32\taskkill.exetaskkill /f /im yandex.exe2⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:4572
-
-
C:\Windows\system32\taskkill.exetaskkill /f /im browser.exe2⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:208
-
-
C:\Windows\system32\taskkill.exetaskkill /f /im eset.exe2⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:2088
-
-
C:\Windows\system32\taskkill.exetaskkill /f /im protogent.exe2⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:2340
-
-
C:\Windows\system32\taskkill.exetaskkill /f /im regedit2⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:1728
-
-
C:\Windows\system32\taskkill.exetaskkill /f /im rundll32.exe2⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:4796
-
-
C:\Windows\system32\taskkill.exetaskkill /f /im rundll.exe2⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:716
-
-
C:\Windows\system32\taskkill.exetaskkill /f /im dllhost.exe2⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:1816
-
-
C:\Windows\system32\taskkill.exetaskkill /f /im superaltf4.exe2⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:1480
-
-
C:\Windows\system32\taskkill.exetaskkill /f /im msedge.exe2⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:3580
-
-
C:\Windows\system32\taskkill.exetaskkill /f /im microsoftedge.exe2⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:3528
-
-
C:\Windows\system32\taskkill.exetaskkill /f /im mrsmjrgui.exe2⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:2460
-
-
C:\Windows\system32\taskkill.exetaskkill /f /im yandex.exe2⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:4768
-