f30ea0f7276100d02319bee64445888af5d784eb12a962ea88f99d2ae4137897

Analysis

max time kernel
147s
max time network
159s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
02/03/2024, 23:24

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
MicrosoftWindowsServicesEtc/AppKill.bat
Size 671B
Sample240302-3d17dsag33
SHA256 5549670ef8837c6e3c4e496c1ea2063670618249d4151dea4d07d48ab456690c
MD5 d4e987817d2e5d6ed2c12633d6f11101
SHA1 3f38430a028f9e3cb66c152e302b3586512dd9c4
SHA512 b84fef88f0128b46f1e2f9c5dff2cb620ee885bed6c90dcf4a5dc51c77bea492c92b8084d8dc8b4277b47b2493a2d9d3f348c6e229bf3da9041ef90e0fd8b6c4
MD5 SHA1 SHA512

Score

1^/10

Malware Config

Signatures

Kills process with taskkill 22 IoCs

evasion

pid	Process
4572	taskkill.exe
2460	taskkill.exe
3284	taskkill.exe
3852	taskkill.exe
4836	taskkill.exe
208	taskkill.exe
2088	taskkill.exe
2340	taskkill.exe
3580	taskkill.exe
4408	taskkill.exe
2112	taskkill.exe
4588	taskkill.exe
4796	taskkill.exe
716	taskkill.exe
3528	taskkill.exe
4768	taskkill.exe
3912	taskkill.exe
768	taskkill.exe
4076	taskkill.exe
1728	taskkill.exe
1816	taskkill.exe
1480	taskkill.exe

Suspicious use of AdjustPrivilegeToken 22 IoCs

description	pid	Process
Token: SeDebugPrivilege	3912	taskkill.exe
Token: SeDebugPrivilege	768	taskkill.exe
Token: SeDebugPrivilege	4408	taskkill.exe
Token: SeDebugPrivilege	3284	taskkill.exe
Token: SeDebugPrivilege	3852	taskkill.exe
Token: SeDebugPrivilege	2112	taskkill.exe
Token: SeDebugPrivilege	4076	taskkill.exe
Token: SeDebugPrivilege	4588	taskkill.exe
Token: SeDebugPrivilege	4836	taskkill.exe
Token: SeDebugPrivilege	4572	taskkill.exe
Token: SeDebugPrivilege	208	taskkill.exe
Token: SeDebugPrivilege	2088	taskkill.exe
Token: SeDebugPrivilege	2340	taskkill.exe
Token: SeDebugPrivilege	1728	taskkill.exe
Token: SeDebugPrivilege	4796	taskkill.exe
Token: SeDebugPrivilege	716	taskkill.exe
Token: SeDebugPrivilege	1816	taskkill.exe
Token: SeDebugPrivilege	1480	taskkill.exe
Token: SeDebugPrivilege	3580	taskkill.exe
Token: SeDebugPrivilege	3528	taskkill.exe
Token: SeDebugPrivilege	2460	taskkill.exe
Token: SeDebugPrivilege	4768	taskkill.exe

Suspicious use of WriteProcessMemory 44 IoCs

description	pid	Process	procid_target
PID 4292 wrote to memory of 3912	4292	cmd.exe	86
PID 4292 wrote to memory of 3912	4292	cmd.exe	86
PID 4292 wrote to memory of 768	4292	cmd.exe	89
PID 4292 wrote to memory of 768	4292	cmd.exe	89
PID 4292 wrote to memory of 4408	4292	cmd.exe	91
PID 4292 wrote to memory of 4408	4292	cmd.exe	91
PID 4292 wrote to memory of 3284	4292	cmd.exe	92
PID 4292 wrote to memory of 3284	4292	cmd.exe	92
PID 4292 wrote to memory of 3852	4292	cmd.exe	93
PID 4292 wrote to memory of 3852	4292	cmd.exe	93
PID 4292 wrote to memory of 2112	4292	cmd.exe	94
PID 4292 wrote to memory of 2112	4292	cmd.exe	94
PID 4292 wrote to memory of 4076	4292	cmd.exe	95
PID 4292 wrote to memory of 4076	4292	cmd.exe	95
PID 4292 wrote to memory of 4588	4292	cmd.exe	96
PID 4292 wrote to memory of 4588	4292	cmd.exe	96
PID 4292 wrote to memory of 4836	4292	cmd.exe	97
PID 4292 wrote to memory of 4836	4292	cmd.exe	97
PID 4292 wrote to memory of 4572	4292	cmd.exe	98
PID 4292 wrote to memory of 4572	4292	cmd.exe	98
PID 4292 wrote to memory of 208	4292	cmd.exe	99
PID 4292 wrote to memory of 208	4292	cmd.exe	99
PID 4292 wrote to memory of 2088	4292	cmd.exe	100
PID 4292 wrote to memory of 2088	4292	cmd.exe	100
PID 4292 wrote to memory of 2340	4292	cmd.exe	101
PID 4292 wrote to memory of 2340	4292	cmd.exe	101
PID 4292 wrote to memory of 1728	4292	cmd.exe	102
PID 4292 wrote to memory of 1728	4292	cmd.exe	102
PID 4292 wrote to memory of 4796	4292	cmd.exe	103
PID 4292 wrote to memory of 4796	4292	cmd.exe	103
PID 4292 wrote to memory of 716	4292	cmd.exe	105
PID 4292 wrote to memory of 716	4292	cmd.exe	105
PID 4292 wrote to memory of 1816	4292	cmd.exe	106
PID 4292 wrote to memory of 1816	4292	cmd.exe	106
PID 4292 wrote to memory of 1480	4292	cmd.exe	107
PID 4292 wrote to memory of 1480	4292	cmd.exe	107
PID 4292 wrote to memory of 3580	4292	cmd.exe	108
PID 4292 wrote to memory of 3580	4292	cmd.exe	108
PID 4292 wrote to memory of 3528	4292	cmd.exe	109
PID 4292 wrote to memory of 3528	4292	cmd.exe	109
PID 4292 wrote to memory of 2460	4292	cmd.exe	110
PID 4292 wrote to memory of 2460	4292	cmd.exe	110
PID 4292 wrote to memory of 4768	4292	cmd.exe	111
PID 4292 wrote to memory of 4768	4292	cmd.exe	111

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\MicrosoftWindowsServicesEtc\AppKill.bat"
1⤵
- Suspicious use of WriteProcessMemory
PID:4292
- C:\Windows\system32\taskkill.exe
  taskkill /f /im chrome.exe
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:3912
- C:\Windows\system32\taskkill.exe
  taskkill /f /im opera.exe
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:768
- C:\Windows\system32\taskkill.exe
  taskkill /f /im mspaint.exe
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:4408
- C:\Windows\system32\taskkill.exe
  taskkill /f /im calc.exe
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:3284
- C:\Windows\system32\taskkill.exe
  taskkill /f /im firefox.exe
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:3852
- C:\Windows\system32\taskkill.exe
  taskkill /f /im ProcessExplorer.exe
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:2112
- C:\Windows\system32\taskkill.exe
  taskkill /f /im ProcessHacker.exe
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:4076
- C:\Windows\system32\taskkill.exe
  taskkill /f /im iexplore.exe
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:4588
- C:\Windows\system32\taskkill.exe
  taskkill /f /im notepad.exe
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:4836
- C:\Windows\system32\taskkill.exe
  taskkill /f /im yandex.exe
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:4572
- C:\Windows\system32\taskkill.exe
  taskkill /f /im browser.exe
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:208
- C:\Windows\system32\taskkill.exe
  taskkill /f /im eset.exe
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:2088
- C:\Windows\system32\taskkill.exe
  taskkill /f /im protogent.exe
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:2340
- C:\Windows\system32\taskkill.exe
  taskkill /f /im regedit
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:1728
- C:\Windows\system32\taskkill.exe
  taskkill /f /im rundll32.exe
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:4796
- C:\Windows\system32\taskkill.exe
  taskkill /f /im rundll.exe
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:716
- C:\Windows\system32\taskkill.exe
  taskkill /f /im dllhost.exe
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:1816
- C:\Windows\system32\taskkill.exe
  taskkill /f /im superaltf4.exe
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:1480
- C:\Windows\system32\taskkill.exe
  taskkill /f /im msedge.exe
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:3580
- C:\Windows\system32\taskkill.exe
  taskkill /f /im microsoftedge.exe
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:3528
- C:\Windows\system32\taskkill.exe
  taskkill /f /im mrsmjrgui.exe
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:2460
- C:\Windows\system32\taskkill.exe
  taskkill /f /im yandex.exe
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:4768

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads