Analysis

  • max time kernel
    209s
  • max time network
    199s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240226-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
  • submitted
    13/03/2024, 19:17

General

  • Target

    serial check.bat

  • Size

    438B

  • MD5

    8cb7166ecf402cedfefee8d08c8ed753

  • SHA1

    cd57e7d640c052cf1431750fd82a7dd2ac369c75

  • SHA256

    68f92fb45c02797eb6ab5cc1f406a35327e8a68b8d2eeb0e7d171d3d2225b0cc

  • SHA512

    af0b1f19da5a2d82c214589b5c2e201d4963833bac179f2426486669493eb6b095c38702a5f4c8ff1467d49d8ef02da6d6fa5bd313b06cc3b860a2c8d8c72454

Score
1/10

Malware Config

Signatures

  • Checks SCSI registry key(s) 3 TTPs 3 IoCs

    SCSI information is often read in order to detect sandboxing environments.

  • Suspicious behavior: EnumeratesProcesses 37 IoCs
  • Suspicious use of AdjustPrivilegeToken 64 IoCs
  • Suspicious use of FindShellTrayWindow 61 IoCs
  • Suspicious use of SendNotifyMessage 60 IoCs
  • Suspicious use of WriteProcessMemory 12 IoCs

Processes

  • C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\serial check.bat"
    1⤵
    • Suspicious use of WriteProcessMemory
    PID:4444
    • C:\Windows\System32\Wbem\WMIC.exe
      wmic diskdrive get model, serialnumber
      2⤵
      • Suspicious use of AdjustPrivilegeToken
      PID:4052
    • C:\Windows\System32\Wbem\WMIC.exe
      wmic cpu get serialnumber
      2⤵
      • Suspicious use of AdjustPrivilegeToken
      PID:2176
    • C:\Windows\System32\Wbem\WMIC.exe
      wmic bios get serialnumber
      2⤵
        PID:1292
      • C:\Windows\System32\Wbem\WMIC.exe
        wmic baseboard get serialnumber
        2⤵
          PID:4776
        • C:\Windows\System32\Wbem\WMIC.exe
          wmic path win32_computersystemproduct get uuid
          2⤵
            PID:1648
          • C:\Windows\system32\getmac.exe
            getmac
            2⤵
              PID:468
          • C:\Windows\system32\taskmgr.exe
            "C:\Windows\system32\taskmgr.exe" /4
            1⤵
            • Checks SCSI registry key(s)
            • Suspicious behavior: EnumeratesProcesses
            • Suspicious use of FindShellTrayWindow
            • Suspicious use of SendNotifyMessage
            PID:4560
          • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
            "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=3984 --field-trial-handle=2280,i,11703952675008463361,17436195144517971517,262144 --variations-seed-version /prefetch:8
            1⤵
              PID:1484

            Network

                  MITRE ATT&CK Enterprise v15

                  Replay Monitor

                  Loading Replay Monitor...

                  Downloads

                  • memory/4560-2-0x000001DD33FE0000-0x000001DD33FE1000-memory.dmp

                    Filesize

                    4KB

                  • memory/4560-0-0x000001DD33FE0000-0x000001DD33FE1000-memory.dmp

                    Filesize

                    4KB

                  • memory/4560-1-0x000001DD33FE0000-0x000001DD33FE1000-memory.dmp

                    Filesize

                    4KB

                  • memory/4560-6-0x000001DD33FE0000-0x000001DD33FE1000-memory.dmp

                    Filesize

                    4KB

                  • memory/4560-7-0x000001DD33FE0000-0x000001DD33FE1000-memory.dmp

                    Filesize

                    4KB

                  • memory/4560-8-0x000001DD33FE0000-0x000001DD33FE1000-memory.dmp

                    Filesize

                    4KB

                  • memory/4560-9-0x000001DD33FE0000-0x000001DD33FE1000-memory.dmp

                    Filesize

                    4KB

                  • memory/4560-10-0x000001DD33FE0000-0x000001DD33FE1000-memory.dmp

                    Filesize

                    4KB

                  • memory/4560-12-0x000001DD33FE0000-0x000001DD33FE1000-memory.dmp

                    Filesize

                    4KB

                  • memory/4560-11-0x000001DD33FE0000-0x000001DD33FE1000-memory.dmp

                    Filesize

                    4KB