ab7ef836e52bda5433e014057e88a57def522ef7e225a1a406208b19ac75e9a9

Resubmissions

16-03-2024 00:38

240316-azfhlahb59 10

16-03-2024 00:34

240316-aw1z5aha92 10

Analysis

max time kernel
120s
max time network
120s
platform
windows7_x64
resource
win7-20231129-en
resource tags

arch:x64arch:x86image:win7-20231129-enlocale:en-usos:windows7-x64system
submitted
16-03-2024 00:34

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

csgo-cs2-spoofer-main/Taskbar.Kill/Taskkill_clean.bat
Size

2KB
MD5

712c005ebe175282f4fd644144f8bcd5
SHA1

e3167aa2650dc6d15f295a6de9e2b83211f565c3
SHA256

540ba332bbf723178fe9b662c528dfa91e0aa08f924f4d557664316b2649507a
SHA512

108021facba33c0297490defa830947fc437d3f1522c8fb874f52d4235b77ecdc88ae66537b2c07c89815b31a38e756207e0d4ca5d2ca6b134939fc2fc2481a1

Score

8^/10

evasion

Malware Config

Signatures

Stops running service(s) 3 TTPs
evasion

Windows Service
T1543.003

Impair Defenses
T1562

Service Stop
T1489

Launches sc.exe 9 IoCs

Sc.exe is a Windows utlilty to control services on the system.

pid	Process
1692	sc.exe
3024	sc.exe
1500	sc.exe
1016	sc.exe
1740	sc.exe
2072	sc.exe
1916	sc.exe
888	sc.exe
2300	sc.exe

Gathers network information 2 TTPs 1 IoCs

Uses commandline utility to view network configuration.

System Information Discovery

T1082

Command and Scripting Interpreter

T1059

pid	Process
2588	ipconfig.exe

Kills process with taskkill 45 IoCs

evasion

pid	Process
2328	taskkill.exe
1204	taskkill.exe
584	taskkill.exe
2404	taskkill.exe
2632	taskkill.exe
2472	taskkill.exe
2324	taskkill.exe
2068	taskkill.exe
676	taskkill.exe
2416	taskkill.exe
1512	taskkill.exe
2664	taskkill.exe
2496	taskkill.exe
804	taskkill.exe
1648	taskkill.exe
852	taskkill.exe
2308	taskkill.exe
776	taskkill.exe
2928	taskkill.exe
3068	taskkill.exe
808	taskkill.exe
1968	taskkill.exe
668	taskkill.exe
3036	taskkill.exe
2544	taskkill.exe
1900	taskkill.exe
2816	taskkill.exe
2252	taskkill.exe
2704	taskkill.exe
2436	taskkill.exe
772	taskkill.exe
2716	taskkill.exe
1620	taskkill.exe
1128	taskkill.exe
1924	taskkill.exe
2524	taskkill.exe
2748	taskkill.exe
1212	taskkill.exe
640	taskkill.exe
700	taskkill.exe
1544	taskkill.exe
1808	taskkill.exe
2064	taskkill.exe
2576	taskkill.exe
2548	taskkill.exe

Runs ping.exe 1 TTPs 2 IoCs

Remote System Discovery

T1018

pid	Process
1716	PING.EXE
2540	PING.EXE

Suspicious use of AdjustPrivilegeToken 45 IoCs

description	pid	Process
Token: SeDebugPrivilege	2928	taskkill.exe
Token: SeDebugPrivilege	2524	taskkill.exe
Token: SeDebugPrivilege	2632	taskkill.exe
Token: SeDebugPrivilege	2664	taskkill.exe
Token: SeDebugPrivilege	2576	taskkill.exe
Token: SeDebugPrivilege	2548	taskkill.exe
Token: SeDebugPrivilege	2704	taskkill.exe
Token: SeDebugPrivilege	2472	taskkill.exe
Token: SeDebugPrivilege	2544	taskkill.exe
Token: SeDebugPrivilege	2436	taskkill.exe
Token: SeDebugPrivilege	2496	taskkill.exe
Token: SeDebugPrivilege	2748	taskkill.exe
Token: SeDebugPrivilege	3068	taskkill.exe
Token: SeDebugPrivilege	2328	taskkill.exe
Token: SeDebugPrivilege	804	taskkill.exe
Token: SeDebugPrivilege	2324	taskkill.exe
Token: SeDebugPrivilege	1204	taskkill.exe
Token: SeDebugPrivilege	1900	taskkill.exe
Token: SeDebugPrivilege	772	taskkill.exe
Token: SeDebugPrivilege	1648	taskkill.exe
Token: SeDebugPrivilege	852	taskkill.exe
Token: SeDebugPrivilege	2716	taskkill.exe
Token: SeDebugPrivilege	808	taskkill.exe
Token: SeDebugPrivilege	1620	taskkill.exe
Token: SeDebugPrivilege	2068	taskkill.exe
Token: SeDebugPrivilege	1212	taskkill.exe
Token: SeDebugPrivilege	1968	taskkill.exe
Token: SeDebugPrivilege	676	taskkill.exe
Token: SeDebugPrivilege	668	taskkill.exe
Token: SeDebugPrivilege	584	taskkill.exe
Token: SeDebugPrivilege	640	taskkill.exe
Token: SeDebugPrivilege	2308	taskkill.exe
Token: SeDebugPrivilege	1128	taskkill.exe
Token: SeDebugPrivilege	2404	taskkill.exe
Token: SeDebugPrivilege	2816	taskkill.exe
Token: SeDebugPrivilege	700	taskkill.exe
Token: SeDebugPrivilege	2252	taskkill.exe
Token: SeDebugPrivilege	1544	taskkill.exe
Token: SeDebugPrivilege	776	taskkill.exe
Token: SeDebugPrivilege	1808	taskkill.exe
Token: SeDebugPrivilege	2416	taskkill.exe
Token: SeDebugPrivilege	2064	taskkill.exe
Token: SeDebugPrivilege	3036	taskkill.exe
Token: SeDebugPrivilege	1512	taskkill.exe
Token: SeDebugPrivilege	1924	taskkill.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2620 wrote to memory of 2928	2620	cmd.exe	29
PID 2620 wrote to memory of 2928	2620	cmd.exe	29
PID 2620 wrote to memory of 2928	2620	cmd.exe	29
PID 2620 wrote to memory of 2524	2620	cmd.exe	31
PID 2620 wrote to memory of 2524	2620	cmd.exe	31
PID 2620 wrote to memory of 2524	2620	cmd.exe	31
PID 2620 wrote to memory of 2632	2620	cmd.exe	32
PID 2620 wrote to memory of 2632	2620	cmd.exe	32
PID 2620 wrote to memory of 2632	2620	cmd.exe	32
PID 2620 wrote to memory of 2664	2620	cmd.exe	33
PID 2620 wrote to memory of 2664	2620	cmd.exe	33
PID 2620 wrote to memory of 2664	2620	cmd.exe	33
PID 2620 wrote to memory of 2576	2620	cmd.exe	34
PID 2620 wrote to memory of 2576	2620	cmd.exe	34
PID 2620 wrote to memory of 2576	2620	cmd.exe	34
PID 2620 wrote to memory of 2548	2620	cmd.exe	35
PID 2620 wrote to memory of 2548	2620	cmd.exe	35
PID 2620 wrote to memory of 2548	2620	cmd.exe	35
PID 2620 wrote to memory of 2704	2620	cmd.exe	36
PID 2620 wrote to memory of 2704	2620	cmd.exe	36
PID 2620 wrote to memory of 2704	2620	cmd.exe	36
PID 2620 wrote to memory of 2472	2620	cmd.exe	37
PID 2620 wrote to memory of 2472	2620	cmd.exe	37
PID 2620 wrote to memory of 2472	2620	cmd.exe	37
PID 2620 wrote to memory of 2544	2620	cmd.exe	38
PID 2620 wrote to memory of 2544	2620	cmd.exe	38
PID 2620 wrote to memory of 2544	2620	cmd.exe	38
PID 2620 wrote to memory of 2436	2620	cmd.exe	39
PID 2620 wrote to memory of 2436	2620	cmd.exe	39
PID 2620 wrote to memory of 2436	2620	cmd.exe	39
PID 2620 wrote to memory of 2496	2620	cmd.exe	40
PID 2620 wrote to memory of 2496	2620	cmd.exe	40
PID 2620 wrote to memory of 2496	2620	cmd.exe	40
PID 2620 wrote to memory of 2748	2620	cmd.exe	41
PID 2620 wrote to memory of 2748	2620	cmd.exe	41
PID 2620 wrote to memory of 2748	2620	cmd.exe	41
PID 2620 wrote to memory of 3068	2620	cmd.exe	42
PID 2620 wrote to memory of 3068	2620	cmd.exe	42
PID 2620 wrote to memory of 3068	2620	cmd.exe	42
PID 2620 wrote to memory of 2328	2620	cmd.exe	43
PID 2620 wrote to memory of 2328	2620	cmd.exe	43
PID 2620 wrote to memory of 2328	2620	cmd.exe	43
PID 2620 wrote to memory of 804	2620	cmd.exe	44
PID 2620 wrote to memory of 804	2620	cmd.exe	44
PID 2620 wrote to memory of 804	2620	cmd.exe	44
PID 2620 wrote to memory of 2324	2620	cmd.exe	45
PID 2620 wrote to memory of 2324	2620	cmd.exe	45
PID 2620 wrote to memory of 2324	2620	cmd.exe	45
PID 2620 wrote to memory of 1204	2620	cmd.exe	46
PID 2620 wrote to memory of 1204	2620	cmd.exe	46
PID 2620 wrote to memory of 1204	2620	cmd.exe	46
PID 2620 wrote to memory of 1900	2620	cmd.exe	47
PID 2620 wrote to memory of 1900	2620	cmd.exe	47
PID 2620 wrote to memory of 1900	2620	cmd.exe	47
PID 2620 wrote to memory of 772	2620	cmd.exe	48
PID 2620 wrote to memory of 772	2620	cmd.exe	48
PID 2620 wrote to memory of 772	2620	cmd.exe	48
PID 2620 wrote to memory of 1648	2620	cmd.exe	49
PID 2620 wrote to memory of 1648	2620	cmd.exe	49
PID 2620 wrote to memory of 1648	2620	cmd.exe	49
PID 2620 wrote to memory of 852	2620	cmd.exe	50
PID 2620 wrote to memory of 852	2620	cmd.exe	50
PID 2620 wrote to memory of 852	2620	cmd.exe	50
PID 2620 wrote to memory of 2716	2620	cmd.exe	51

C:\Windows\system32\cmd.exe
cmd /c "C:\Users\Admin\AppData\Local\Temp\csgo-cs2-spoofer-main\Taskbar.Kill\Taskkill_clean.bat"
1⤵
- Suspicious use of WriteProcessMemory
PID:2620
- C:\Windows\system32\taskkill.exe
  taskkill /f /im epicgameslauncher.exe
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:2928
- C:\Windows\system32\taskkill.exe
  taskkill /f /im FortniteClient-Win64-Shipping_EAC.exe
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:2524
- C:\Windows\system32\taskkill.exe
  taskkill /f /im FortniteClient-Win64-Shipping.exe
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:2632
- C:\Windows\system32\taskkill.exe
  taskkill /f /im FortniteClient-Win64-Shipping_BE.exe
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:2664
- C:\Windows\system32\taskkill.exe
  taskkill /f /im FortniteLauncher.exe
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:2576
- C:\Windows\system32\taskkill.exe
  taskkill /f /im EpicGamesLauncher.exe
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:2548
- C:\Windows\system32\taskkill.exe
  taskkill /f /im FortniteClient-Win64-Shipping.exe
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:2704
- C:\Windows\system32\taskkill.exe
  taskkill /f /im EpicGamesLauncher.exe
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:2472
- C:\Windows\system32\taskkill.exe
  taskkill /f /im EasyAntiCheat_Setup.exe
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:2544
- C:\Windows\system32\taskkill.exe
  taskkill /f /im FortniteLauncher.exe
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:2436
- C:\Windows\system32\taskkill.exe
  taskkill /f /im EpicWebHelper.exe
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:2496
- C:\Windows\system32\taskkill.exe
  taskkill /f /im FortniteClient-Win64-Shipping.exe
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:2748
- C:\Windows\system32\taskkill.exe
  taskkill /f /im EasyAntiCheat.exe
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:3068
- C:\Windows\system32\taskkill.exe
  taskkill /f /im BEService_x64.exe
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:2328
- C:\Windows\system32\taskkill.exe
  taskkill /f /im EpicGamesLauncher.exe
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:804
- C:\Windows\system32\taskkill.exe
  taskkill /f /im FortniteClient-Win64-Shipping_BE.exe
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:2324
- C:\Windows\system32\taskkill.exe
  taskkill /f /im FortniteClient-Win64-Shipping_EAC.exe
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:1204
- C:\Windows\system32\taskkill.exe
  taskkill /f /im smartscreen.exe
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:1900
- C:\Windows\system32\taskkill.exe
  taskkill /f /im EasyAntiCheat.exe
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:772
- C:\Windows\system32\taskkill.exe
  taskkill /f /im dnf.exe
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:1648
- C:\Windows\system32\taskkill.exe
  taskkill /f /im DNF.exe
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:852
- C:\Windows\system32\taskkill.exe
  taskkill /f /im CrossProxy.exe
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:2716
- C:\Windows\system32\taskkill.exe
  taskkill /f /im tensafe_1.exe
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:808
- C:\Windows\system32\taskkill.exe
  taskkill /f /im TenSafe_1.exe
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:1620
- C:\Windows\system32\taskkill.exe
  taskkill /f /im tensafe_2.exe
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:2068
- C:\Windows\system32\taskkill.exe
  taskkill /f /im tencentdl.exe
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:1212
- C:\Windows\system32\taskkill.exe
  taskkill /f /im TenioDL.exe
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:1968
- C:\Windows\system32\taskkill.exe
  taskkill /f /im uishell.exe
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:676
- C:\Windows\system32\taskkill.exe
  taskkill /f /im BackgroundDownloader.exe
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:668
- C:\Windows\system32\taskkill.exe
  taskkill /f /im conime.exe
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:584
- C:\Windows\system32\taskkill.exe
  taskkill /f /im QQDL.EXE
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:640
- C:\Windows\system32\taskkill.exe
  taskkill /f /im qqlogin.exe
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:2308
- C:\Windows\system32\taskkill.exe
  taskkill /f /im dnfchina.exe
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:1128
- C:\Windows\system32\taskkill.exe
  taskkill /f /im dnfchinatest.exe
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:2404
- C:\Windows\system32\taskkill.exe
  taskkill /f /im dnf.exe
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:2816
- C:\Windows\system32\taskkill.exe
  taskkill /f /im txplatform.exe
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:700
- C:\Windows\system32\taskkill.exe
  taskkill /f /im TXPlatform.exe
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:2252
- C:\Windows\system32\taskkill.exe
  taskkill /f /im OriginWebHelperService.exe
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:1544
- C:\Windows\system32\taskkill.exe
  taskkill /f /im Origin.exe
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:776
- C:\Windows\system32\taskkill.exe
  taskkill /f /im OriginClientService.exe
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:1808
- C:\Windows\system32\taskkill.exe
  taskkill /f /im OriginER.exe
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:2416
- C:\Windows\system32\taskkill.exe
  taskkill /f /im OriginThinSetupInternal.exe
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:2064
- C:\Windows\system32\taskkill.exe
  taskkill /f /im OriginLegacyCLI.exe
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:3036
- C:\Windows\system32\taskkill.exe
  taskkill /f /im Agent.exe
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:1512
- C:\Windows\system32\taskkill.exe
  taskkill /f /im Client.exe
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:1924
- C:\Windows\system32\sc.exe
  sc stop Steam
  2⤵
  - Launches sc.exe
  PID:1916
- C:\Windows\system32\sc.exe
  sc stop BEService
  2⤵
  - Launches sc.exe
  PID:3024
- C:\Windows\system32\sc.exe
  sc stop EasyAntiCheat
  2⤵
  - Launches sc.exe
  PID:1500
- C:\Windows\system32\sc.exe
  sc stop PunkBuster
  2⤵
  - Launches sc.exe
  PID:1016
- C:\Windows\system32\sc.exe
  sc stop Vanguard
  2⤵
  - Launches sc.exe
  PID:1740
- C:\Windows\system32\sc.exe
  sc stop ricocheat
  2⤵
  - Launches sc.exe
  PID:2072
- C:\Windows\system32\sc.exe
  sc stop defender
  2⤵
  - Launches sc.exe
  PID:888
- C:\Windows\system32\sc.exe
  sc stop firewall
  2⤵
  - Launches sc.exe
  PID:1692
- C:\Windows\system32\sc.exe
  sc stop explorer
  2⤵
  - Launches sc.exe
  PID:2300
- C:\Windows\system32\PING.EXE
  ping -n 1 google.com
  2⤵
  - Runs ping.exe
  PID:1716
- C:\Windows\system32\netsh.exe
  netsh wlan connect name="your_wifi_network_name"
  2⤵
  PID:2800
- C:\Windows\system32\PING.EXE
  ping -n 1 google.com
  2⤵
  - Runs ping.exe
  PID:2540
- C:\Windows\system32\ipconfig.exe
  ipconfig /all
  2⤵
  - Gathers network information
  PID:2588