e92d9cf98abe2f1821e4c426d493fe3378661520e6f961e734258338fc5921d4 | Triage

Analysis

max time kernel
0s
max time network
2s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
05-03-2024 19:50

Sharing

Report Analysis Logs

General

Target

notbad.bat
Size

27B
MD5

c729d940eb78e927afcba4046543d8f8
SHA1

3522981616693e8b12ca21a51f07b98a5008a075
SHA256

e92d9cf98abe2f1821e4c426d493fe3378661520e6f961e734258338fc5921d4
SHA512

8aa7d80e1216d0f82a4056f2cf152ec96a74c04e9e6b903dc9614a7a45e1bf2f150db0028b5bc285b0b4222b179c120b08a87d57e9accbed360d8a9cf4e2d642

Score

1^/10

Malware Config

Signatures

Kills process with taskkill 1 IoCs

pid	Process
2356	taskkill.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	2356	taskkill.exe

Suspicious use of WriteProcessMemory 2 IoCs

description	pid	Process	procid_target
PID 532 wrote to memory of 2356	532	cmd.exe	89
PID 532 wrote to memory of 2356	532	cmd.exe	89

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\notbad.bat"
1⤵
- Suspicious use of WriteProcessMemory
PID:532
- C:\Windows\system32\taskkill.exe
  taskkill /f /im svchost.exe
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:2356

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads