ab7ef836e52bda5433e014057e88a57def522ef7e225a1a406208b19ac75e9a9

Resubmissions

16-03-2024 00:38

240316-azfhlahb59 10

16-03-2024 00:34

240316-aw1z5aha92 10

Analysis

max time kernel
148s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
16-03-2024 00:34

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

csgo-cs2-spoofer-main/Taskbar.Kill/Taskkill_clean.bat
Size

2KB
MD5

712c005ebe175282f4fd644144f8bcd5
SHA1

e3167aa2650dc6d15f295a6de9e2b83211f565c3
SHA256

540ba332bbf723178fe9b662c528dfa91e0aa08f924f4d557664316b2649507a
SHA512

108021facba33c0297490defa830947fc437d3f1522c8fb874f52d4235b77ecdc88ae66537b2c07c89815b31a38e756207e0d4ca5d2ca6b134939fc2fc2481a1

Score

8^/10

evasion

Malware Config

Signatures

Stops running service(s) 3 TTPs
evasion

Windows Service
T1543.003

Impair Defenses
T1562

Service Stop
T1489

Launches sc.exe 9 IoCs

Sc.exe is a Windows utlilty to control services on the system.

pid	Process
1272	sc.exe
1036	sc.exe
632	sc.exe
1224	sc.exe
4568	sc.exe
2668	sc.exe
1544	sc.exe
1340	sc.exe
1996	sc.exe

Gathers network information 2 TTPs 1 IoCs

Uses commandline utility to view network configuration.

System Information Discovery

T1082

Command and Scripting Interpreter

T1059

pid	Process
2988	ipconfig.exe

Kills process with taskkill 45 IoCs

evasion

pid	Process
3064	taskkill.exe
2564	taskkill.exe
4816	taskkill.exe
1512	taskkill.exe
2808	taskkill.exe
4244	taskkill.exe
3736	taskkill.exe
3208	taskkill.exe
4920	taskkill.exe
3648	taskkill.exe
1160	taskkill.exe
660	taskkill.exe
684	taskkill.exe
2988	taskkill.exe
836	taskkill.exe
2920	taskkill.exe
1904	taskkill.exe
2268	taskkill.exe
4308	taskkill.exe
3660	taskkill.exe
3936	taskkill.exe
3616	taskkill.exe
3764	taskkill.exe
4556	taskkill.exe
2472	taskkill.exe
4536	taskkill.exe
2012	taskkill.exe
4644	taskkill.exe
2484	taskkill.exe
4724	taskkill.exe
2740	taskkill.exe
2024	taskkill.exe
4876	taskkill.exe
4656	taskkill.exe
1276	taskkill.exe
2728	taskkill.exe
4352	taskkill.exe
520	taskkill.exe
1384	taskkill.exe
4192	taskkill.exe
8	taskkill.exe
380	taskkill.exe
1576	taskkill.exe
2544	taskkill.exe
4768	taskkill.exe

Runs ping.exe 1 TTPs 2 IoCs

Remote System Discovery

T1018

pid	Process
4808	PING.EXE
2808	PING.EXE

Suspicious use of AdjustPrivilegeToken 45 IoCs

description	pid	Process
Token: SeDebugPrivilege	4556	taskkill.exe
Token: SeDebugPrivilege	4876	taskkill.exe
Token: SeDebugPrivilege	660	taskkill.exe
Token: SeDebugPrivilege	684	taskkill.exe
Token: SeDebugPrivilege	4656	taskkill.exe
Token: SeDebugPrivilege	2472	taskkill.exe
Token: SeDebugPrivilege	2268	taskkill.exe
Token: SeDebugPrivilege	4536	taskkill.exe
Token: SeDebugPrivilege	4816	taskkill.exe
Token: SeDebugPrivilege	2012	taskkill.exe
Token: SeDebugPrivilege	1276	taskkill.exe
Token: SeDebugPrivilege	380	taskkill.exe
Token: SeDebugPrivilege	2728	taskkill.exe
Token: SeDebugPrivilege	4352	taskkill.exe
Token: SeDebugPrivilege	1512	taskkill.exe
Token: SeDebugPrivilege	2808	taskkill.exe
Token: SeDebugPrivilege	4244	taskkill.exe
Token: SeDebugPrivilege	3736	taskkill.exe
Token: SeDebugPrivilege	4644	taskkill.exe
Token: SeDebugPrivilege	520	taskkill.exe
Token: SeDebugPrivilege	1576	taskkill.exe
Token: SeDebugPrivilege	2740	taskkill.exe
Token: SeDebugPrivilege	2484	taskkill.exe
Token: SeDebugPrivilege	2988	taskkill.exe
Token: SeDebugPrivilege	3208	taskkill.exe
Token: SeDebugPrivilege	2024	taskkill.exe
Token: SeDebugPrivilege	836	taskkill.exe
Token: SeDebugPrivilege	3616	taskkill.exe
Token: SeDebugPrivilege	2920	taskkill.exe
Token: SeDebugPrivilege	3764	taskkill.exe
Token: SeDebugPrivilege	1384	taskkill.exe
Token: SeDebugPrivilege	2544	taskkill.exe
Token: SeDebugPrivilege	4724	taskkill.exe
Token: SeDebugPrivilege	1904	taskkill.exe
Token: SeDebugPrivilege	4192	taskkill.exe
Token: SeDebugPrivilege	4308	taskkill.exe
Token: SeDebugPrivilege	3064	taskkill.exe
Token: SeDebugPrivilege	3660	taskkill.exe
Token: SeDebugPrivilege	4920	taskkill.exe
Token: SeDebugPrivilege	3936	taskkill.exe
Token: SeDebugPrivilege	2564	taskkill.exe
Token: SeDebugPrivilege	8	taskkill.exe
Token: SeDebugPrivilege	3648	taskkill.exe
Token: SeDebugPrivilege	4768	taskkill.exe
Token: SeDebugPrivilege	1160	taskkill.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2876 wrote to memory of 4556	2876	cmd.exe	91
PID 2876 wrote to memory of 4556	2876	cmd.exe	91
PID 2876 wrote to memory of 4876	2876	cmd.exe	93
PID 2876 wrote to memory of 4876	2876	cmd.exe	93
PID 2876 wrote to memory of 660	2876	cmd.exe	94
PID 2876 wrote to memory of 660	2876	cmd.exe	94
PID 2876 wrote to memory of 684	2876	cmd.exe	95
PID 2876 wrote to memory of 684	2876	cmd.exe	95
PID 2876 wrote to memory of 4656	2876	cmd.exe	96
PID 2876 wrote to memory of 4656	2876	cmd.exe	96
PID 2876 wrote to memory of 2472	2876	cmd.exe	97
PID 2876 wrote to memory of 2472	2876	cmd.exe	97
PID 2876 wrote to memory of 2268	2876	cmd.exe	98
PID 2876 wrote to memory of 2268	2876	cmd.exe	98
PID 2876 wrote to memory of 4536	2876	cmd.exe	99
PID 2876 wrote to memory of 4536	2876	cmd.exe	99
PID 2876 wrote to memory of 4816	2876	cmd.exe	101
PID 2876 wrote to memory of 4816	2876	cmd.exe	101
PID 2876 wrote to memory of 2012	2876	cmd.exe	102
PID 2876 wrote to memory of 2012	2876	cmd.exe	102
PID 2876 wrote to memory of 1276	2876	cmd.exe	103
PID 2876 wrote to memory of 1276	2876	cmd.exe	103
PID 2876 wrote to memory of 380	2876	cmd.exe	105
PID 2876 wrote to memory of 380	2876	cmd.exe	105
PID 2876 wrote to memory of 2728	2876	cmd.exe	106
PID 2876 wrote to memory of 2728	2876	cmd.exe	106
PID 2876 wrote to memory of 4352	2876	cmd.exe	107
PID 2876 wrote to memory of 4352	2876	cmd.exe	107
PID 2876 wrote to memory of 1512	2876	cmd.exe	108
PID 2876 wrote to memory of 1512	2876	cmd.exe	108
PID 2876 wrote to memory of 2808	2876	cmd.exe	109
PID 2876 wrote to memory of 2808	2876	cmd.exe	109
PID 2876 wrote to memory of 4244	2876	cmd.exe	110
PID 2876 wrote to memory of 4244	2876	cmd.exe	110
PID 2876 wrote to memory of 3736	2876	cmd.exe	111
PID 2876 wrote to memory of 3736	2876	cmd.exe	111
PID 2876 wrote to memory of 4644	2876	cmd.exe	112
PID 2876 wrote to memory of 4644	2876	cmd.exe	112
PID 2876 wrote to memory of 520	2876	cmd.exe	113
PID 2876 wrote to memory of 520	2876	cmd.exe	113
PID 2876 wrote to memory of 1576	2876	cmd.exe	114
PID 2876 wrote to memory of 1576	2876	cmd.exe	114
PID 2876 wrote to memory of 2740	2876	cmd.exe	115
PID 2876 wrote to memory of 2740	2876	cmd.exe	115
PID 2876 wrote to memory of 2484	2876	cmd.exe	116
PID 2876 wrote to memory of 2484	2876	cmd.exe	116
PID 2876 wrote to memory of 2988	2876	cmd.exe	117
PID 2876 wrote to memory of 2988	2876	cmd.exe	117
PID 2876 wrote to memory of 3208	2876	cmd.exe	118
PID 2876 wrote to memory of 3208	2876	cmd.exe	118
PID 2876 wrote to memory of 2024	2876	cmd.exe	119
PID 2876 wrote to memory of 2024	2876	cmd.exe	119
PID 2876 wrote to memory of 836	2876	cmd.exe	120
PID 2876 wrote to memory of 836	2876	cmd.exe	120
PID 2876 wrote to memory of 3616	2876	cmd.exe	121
PID 2876 wrote to memory of 3616	2876	cmd.exe	121
PID 2876 wrote to memory of 2920	2876	cmd.exe	122
PID 2876 wrote to memory of 2920	2876	cmd.exe	122
PID 2876 wrote to memory of 3764	2876	cmd.exe	123
PID 2876 wrote to memory of 3764	2876	cmd.exe	123
PID 2876 wrote to memory of 1384	2876	cmd.exe	124
PID 2876 wrote to memory of 1384	2876	cmd.exe	124
PID 2876 wrote to memory of 2544	2876	cmd.exe	125
PID 2876 wrote to memory of 2544	2876	cmd.exe	125

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\csgo-cs2-spoofer-main\Taskbar.Kill\Taskkill_clean.bat"
1⤵
- Suspicious use of WriteProcessMemory
PID:2876
- C:\Windows\system32\taskkill.exe
  taskkill /f /im epicgameslauncher.exe
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:4556
- C:\Windows\system32\taskkill.exe
  taskkill /f /im FortniteClient-Win64-Shipping_EAC.exe
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:4876
- C:\Windows\system32\taskkill.exe
  taskkill /f /im FortniteClient-Win64-Shipping.exe
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:660
- C:\Windows\system32\taskkill.exe
  taskkill /f /im FortniteClient-Win64-Shipping_BE.exe
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:684
- C:\Windows\system32\taskkill.exe
  taskkill /f /im FortniteLauncher.exe
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:4656
- C:\Windows\system32\taskkill.exe
  taskkill /f /im EpicGamesLauncher.exe
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:2472
- C:\Windows\system32\taskkill.exe
  taskkill /f /im FortniteClient-Win64-Shipping.exe
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:2268
- C:\Windows\system32\taskkill.exe
  taskkill /f /im EpicGamesLauncher.exe
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:4536
- C:\Windows\system32\taskkill.exe
  taskkill /f /im EasyAntiCheat_Setup.exe
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:4816
- C:\Windows\system32\taskkill.exe
  taskkill /f /im FortniteLauncher.exe
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:2012
- C:\Windows\system32\taskkill.exe
  taskkill /f /im EpicWebHelper.exe
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:1276
- C:\Windows\system32\taskkill.exe
  taskkill /f /im FortniteClient-Win64-Shipping.exe
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:380
- C:\Windows\system32\taskkill.exe
  taskkill /f /im EasyAntiCheat.exe
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:2728
- C:\Windows\system32\taskkill.exe
  taskkill /f /im BEService_x64.exe
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:4352
- C:\Windows\system32\taskkill.exe
  taskkill /f /im EpicGamesLauncher.exe
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:1512
- C:\Windows\system32\taskkill.exe
  taskkill /f /im FortniteClient-Win64-Shipping_BE.exe
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:2808
- C:\Windows\system32\taskkill.exe
  taskkill /f /im FortniteClient-Win64-Shipping_EAC.exe
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:4244
- C:\Windows\system32\taskkill.exe
  taskkill /f /im smartscreen.exe
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:3736
- C:\Windows\system32\taskkill.exe
  taskkill /f /im EasyAntiCheat.exe
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:4644
- C:\Windows\system32\taskkill.exe
  taskkill /f /im dnf.exe
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:520
- C:\Windows\system32\taskkill.exe
  taskkill /f /im DNF.exe
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:1576
- C:\Windows\system32\taskkill.exe
  taskkill /f /im CrossProxy.exe
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:2740
- C:\Windows\system32\taskkill.exe
  taskkill /f /im tensafe_1.exe
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:2484
- C:\Windows\system32\taskkill.exe
  taskkill /f /im TenSafe_1.exe
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:2988
- C:\Windows\system32\taskkill.exe
  taskkill /f /im tensafe_2.exe
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:3208
- C:\Windows\system32\taskkill.exe
  taskkill /f /im tencentdl.exe
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:2024
- C:\Windows\system32\taskkill.exe
  taskkill /f /im TenioDL.exe
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:836
- C:\Windows\system32\taskkill.exe
  taskkill /f /im uishell.exe
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:3616
- C:\Windows\system32\taskkill.exe
  taskkill /f /im BackgroundDownloader.exe
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:2920
- C:\Windows\system32\taskkill.exe
  taskkill /f /im conime.exe
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:3764
- C:\Windows\system32\taskkill.exe
  taskkill /f /im QQDL.EXE
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:1384
- C:\Windows\system32\taskkill.exe
  taskkill /f /im qqlogin.exe
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:2544
- C:\Windows\system32\taskkill.exe
  taskkill /f /im dnfchina.exe
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:4724
- C:\Windows\system32\taskkill.exe
  taskkill /f /im dnfchinatest.exe
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:1904
- C:\Windows\system32\taskkill.exe
  taskkill /f /im dnf.exe
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:4192
- C:\Windows\system32\taskkill.exe
  taskkill /f /im txplatform.exe
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:4308
- C:\Windows\system32\taskkill.exe
  taskkill /f /im TXPlatform.exe
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:3064
- C:\Windows\system32\taskkill.exe
  taskkill /f /im OriginWebHelperService.exe
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:3660
- C:\Windows\system32\taskkill.exe
  taskkill /f /im Origin.exe
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:4920
- C:\Windows\system32\taskkill.exe
  taskkill /f /im OriginClientService.exe
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:3936
- C:\Windows\system32\taskkill.exe
  taskkill /f /im OriginER.exe
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:2564
- C:\Windows\system32\taskkill.exe
  taskkill /f /im OriginThinSetupInternal.exe
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:8
- C:\Windows\system32\taskkill.exe
  taskkill /f /im OriginLegacyCLI.exe
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:3648
- C:\Windows\system32\taskkill.exe
  taskkill /f /im Agent.exe
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:4768
- C:\Windows\system32\taskkill.exe
  taskkill /f /im Client.exe
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:1160
- C:\Windows\system32\sc.exe
  sc stop Steam
  2⤵
  - Launches sc.exe
  PID:1272
- C:\Windows\system32\sc.exe
  sc stop BEService
  2⤵
  - Launches sc.exe
  PID:4568
- C:\Windows\system32\sc.exe
  sc stop EasyAntiCheat
  2⤵
  - Launches sc.exe
  PID:2668
- C:\Windows\system32\sc.exe
  sc stop PunkBuster
  2⤵
  - Launches sc.exe
  PID:1036
- C:\Windows\system32\sc.exe
  sc stop Vanguard
  2⤵
  - Launches sc.exe
  PID:1544
- C:\Windows\system32\sc.exe
  sc stop ricocheat
  2⤵
  - Launches sc.exe
  PID:1340
- C:\Windows\system32\sc.exe
  sc stop defender
  2⤵
  - Launches sc.exe
  PID:1996
- C:\Windows\system32\sc.exe
  sc stop firewall
  2⤵
  - Launches sc.exe
  PID:632
- C:\Windows\system32\sc.exe
  sc stop explorer
  2⤵
  - Launches sc.exe
  PID:1224
- C:\Windows\system32\PING.EXE
  ping -n 1 google.com
  2⤵
  - Runs ping.exe
  PID:4808
- C:\Windows\system32\netsh.exe
  netsh wlan connect name="your_wifi_network_name"
  2⤵
  PID:1688
- C:\Windows\system32\PING.EXE
  ping -n 1 google.com
  2⤵
  - Runs ping.exe
  PID:2808
- C:\Windows\system32\ipconfig.exe
  ipconfig /all
  2⤵
  - Gathers network information
  PID:2988