ab7ef836e52bda5433e014057e88a57def522ef7e225a1a406208b19ac75e9a9

Resubmissions

16-03-2024 00:38

240316-azfhlahb59 10

16-03-2024 00:34

240316-aw1z5aha92 10

Analysis

max time kernel
150s
max time network
159s
platform
windows11-21h2_x64
resource
win11-20240221-en
resource tags

arch:x64arch:x86image:win11-20240221-enlocale:en-usos:windows11-21h2-x64system
submitted
16-03-2024 00:38

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

csgo-cs2-spoofer-main/Taskbar.Kill/Taskkill_clean.bat
Size

2KB
MD5

712c005ebe175282f4fd644144f8bcd5
SHA1

e3167aa2650dc6d15f295a6de9e2b83211f565c3
SHA256

540ba332bbf723178fe9b662c528dfa91e0aa08f924f4d557664316b2649507a
SHA512

108021facba33c0297490defa830947fc437d3f1522c8fb874f52d4235b77ecdc88ae66537b2c07c89815b31a38e756207e0d4ca5d2ca6b134939fc2fc2481a1

Score

8^/10

evasion

Malware Config

Signatures

Stops running service(s) 3 TTPs
evasion

Windows Service
T1543.003

Impair Defenses
T1562

Service Stop
T1489

Launches sc.exe 9 IoCs

Sc.exe is a Windows utlilty to control services on the system.

pid	Process
4840	sc.exe
3876	sc.exe
4112	sc.exe
2988	sc.exe
4228	sc.exe
4404	sc.exe
760	sc.exe
2064	sc.exe
1712	sc.exe

Gathers network information 2 TTPs 1 IoCs

Uses commandline utility to view network configuration.

System Information Discovery

T1082

Command and Scripting Interpreter

T1059

pid	Process
812	ipconfig.exe

Kills process with taskkill 45 IoCs

evasion

pid	Process
4896	taskkill.exe
4280	taskkill.exe
5072	taskkill.exe
3312	taskkill.exe
1388	taskkill.exe
4864	taskkill.exe
460	taskkill.exe
2968	taskkill.exe
1672	taskkill.exe
2640	taskkill.exe
2348	taskkill.exe
1292	taskkill.exe
3852	taskkill.exe
4928	taskkill.exe
3024	taskkill.exe
1632	taskkill.exe
2600	taskkill.exe
440	taskkill.exe
4092	taskkill.exe
4376	taskkill.exe
4020	taskkill.exe
5096	taskkill.exe
1184	taskkill.exe
4592	taskkill.exe
3288	taskkill.exe
3392	taskkill.exe
2504	taskkill.exe
1652	taskkill.exe
2180	taskkill.exe
1608	taskkill.exe
4848	taskkill.exe
2376	taskkill.exe
4644	taskkill.exe
3028	taskkill.exe
3576	taskkill.exe
2012	taskkill.exe
2576	taskkill.exe
556	taskkill.exe
4596	taskkill.exe
4636	taskkill.exe
2856	taskkill.exe
1072	taskkill.exe
3144	taskkill.exe
4468	taskkill.exe
2840	taskkill.exe

Runs ping.exe 1 TTPs 2 IoCs

Remote System Discovery

T1018

pid	Process
372	PING.EXE
708	PING.EXE

Suspicious use of AdjustPrivilegeToken 45 IoCs

description	pid	Process
Token: SeDebugPrivilege	1608	taskkill.exe
Token: SeDebugPrivilege	460	taskkill.exe
Token: SeDebugPrivilege	556	taskkill.exe
Token: SeDebugPrivilege	4468	taskkill.exe
Token: SeDebugPrivilege	4848	taskkill.exe
Token: SeDebugPrivilege	4636	taskkill.exe
Token: SeDebugPrivilege	4592	taskkill.exe
Token: SeDebugPrivilege	4376	taskkill.exe
Token: SeDebugPrivilege	4596	taskkill.exe
Token: SeDebugPrivilege	2968	taskkill.exe
Token: SeDebugPrivilege	3288	taskkill.exe
Token: SeDebugPrivilege	4020	taskkill.exe
Token: SeDebugPrivilege	3024	taskkill.exe
Token: SeDebugPrivilege	3392	taskkill.exe
Token: SeDebugPrivilege	5096	taskkill.exe
Token: SeDebugPrivilege	4896	taskkill.exe
Token: SeDebugPrivilege	2504	taskkill.exe
Token: SeDebugPrivilege	1632	taskkill.exe
Token: SeDebugPrivilege	3576	taskkill.exe
Token: SeDebugPrivilege	4280	taskkill.exe
Token: SeDebugPrivilege	1672	taskkill.exe
Token: SeDebugPrivilege	2840	taskkill.exe
Token: SeDebugPrivilege	5072	taskkill.exe
Token: SeDebugPrivilege	1652	taskkill.exe
Token: SeDebugPrivilege	2012	taskkill.exe
Token: SeDebugPrivilege	2600	taskkill.exe
Token: SeDebugPrivilege	2576	taskkill.exe
Token: SeDebugPrivilege	2856	taskkill.exe
Token: SeDebugPrivilege	2180	taskkill.exe
Token: SeDebugPrivilege	2640	taskkill.exe
Token: SeDebugPrivilege	2348	taskkill.exe
Token: SeDebugPrivilege	4644	taskkill.exe
Token: SeDebugPrivilege	1184	taskkill.exe
Token: SeDebugPrivilege	1072	taskkill.exe
Token: SeDebugPrivilege	440	taskkill.exe
Token: SeDebugPrivilege	1292	taskkill.exe
Token: SeDebugPrivilege	3028	taskkill.exe
Token: SeDebugPrivilege	3312	taskkill.exe
Token: SeDebugPrivilege	3144	taskkill.exe
Token: SeDebugPrivilege	4092	taskkill.exe
Token: SeDebugPrivilege	1388	taskkill.exe
Token: SeDebugPrivilege	2376	taskkill.exe
Token: SeDebugPrivilege	3852	taskkill.exe
Token: SeDebugPrivilege	4864	taskkill.exe
Token: SeDebugPrivilege	4928	taskkill.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4372 wrote to memory of 1608	4372	cmd.exe	81
PID 4372 wrote to memory of 1608	4372	cmd.exe	81
PID 4372 wrote to memory of 460	4372	cmd.exe	83
PID 4372 wrote to memory of 460	4372	cmd.exe	83
PID 4372 wrote to memory of 556	4372	cmd.exe	84
PID 4372 wrote to memory of 556	4372	cmd.exe	84
PID 4372 wrote to memory of 4468	4372	cmd.exe	85
PID 4372 wrote to memory of 4468	4372	cmd.exe	85
PID 4372 wrote to memory of 4848	4372	cmd.exe	87
PID 4372 wrote to memory of 4848	4372	cmd.exe	87
PID 4372 wrote to memory of 4636	4372	cmd.exe	88
PID 4372 wrote to memory of 4636	4372	cmd.exe	88
PID 4372 wrote to memory of 4592	4372	cmd.exe	89
PID 4372 wrote to memory of 4592	4372	cmd.exe	89
PID 4372 wrote to memory of 4376	4372	cmd.exe	90
PID 4372 wrote to memory of 4376	4372	cmd.exe	90
PID 4372 wrote to memory of 4596	4372	cmd.exe	91
PID 4372 wrote to memory of 4596	4372	cmd.exe	91
PID 4372 wrote to memory of 2968	4372	cmd.exe	92
PID 4372 wrote to memory of 2968	4372	cmd.exe	92
PID 4372 wrote to memory of 3288	4372	cmd.exe	93
PID 4372 wrote to memory of 3288	4372	cmd.exe	93
PID 4372 wrote to memory of 4020	4372	cmd.exe	94
PID 4372 wrote to memory of 4020	4372	cmd.exe	94
PID 4372 wrote to memory of 3024	4372	cmd.exe	95
PID 4372 wrote to memory of 3024	4372	cmd.exe	95
PID 4372 wrote to memory of 3392	4372	cmd.exe	96
PID 4372 wrote to memory of 3392	4372	cmd.exe	96
PID 4372 wrote to memory of 5096	4372	cmd.exe	97
PID 4372 wrote to memory of 5096	4372	cmd.exe	97
PID 4372 wrote to memory of 4896	4372	cmd.exe	98
PID 4372 wrote to memory of 4896	4372	cmd.exe	98
PID 4372 wrote to memory of 2504	4372	cmd.exe	99
PID 4372 wrote to memory of 2504	4372	cmd.exe	99
PID 4372 wrote to memory of 1632	4372	cmd.exe	100
PID 4372 wrote to memory of 1632	4372	cmd.exe	100
PID 4372 wrote to memory of 3576	4372	cmd.exe	101
PID 4372 wrote to memory of 3576	4372	cmd.exe	101
PID 4372 wrote to memory of 4280	4372	cmd.exe	102
PID 4372 wrote to memory of 4280	4372	cmd.exe	102
PID 4372 wrote to memory of 1672	4372	cmd.exe	103
PID 4372 wrote to memory of 1672	4372	cmd.exe	103
PID 4372 wrote to memory of 2840	4372	cmd.exe	104
PID 4372 wrote to memory of 2840	4372	cmd.exe	104
PID 4372 wrote to memory of 5072	4372	cmd.exe	105
PID 4372 wrote to memory of 5072	4372	cmd.exe	105
PID 4372 wrote to memory of 1652	4372	cmd.exe	106
PID 4372 wrote to memory of 1652	4372	cmd.exe	106
PID 4372 wrote to memory of 2012	4372	cmd.exe	107
PID 4372 wrote to memory of 2012	4372	cmd.exe	107
PID 4372 wrote to memory of 2600	4372	cmd.exe	108
PID 4372 wrote to memory of 2600	4372	cmd.exe	108
PID 4372 wrote to memory of 2576	4372	cmd.exe	109
PID 4372 wrote to memory of 2576	4372	cmd.exe	109
PID 4372 wrote to memory of 2856	4372	cmd.exe	110
PID 4372 wrote to memory of 2856	4372	cmd.exe	110
PID 4372 wrote to memory of 2180	4372	cmd.exe	111
PID 4372 wrote to memory of 2180	4372	cmd.exe	111
PID 4372 wrote to memory of 2640	4372	cmd.exe	112
PID 4372 wrote to memory of 2640	4372	cmd.exe	112
PID 4372 wrote to memory of 2348	4372	cmd.exe	113
PID 4372 wrote to memory of 2348	4372	cmd.exe	113
PID 4372 wrote to memory of 4644	4372	cmd.exe	114
PID 4372 wrote to memory of 4644	4372	cmd.exe	114

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\csgo-cs2-spoofer-main\Taskbar.Kill\Taskkill_clean.bat"
1⤵
- Suspicious use of WriteProcessMemory
PID:4372
- C:\Windows\system32\taskkill.exe
  taskkill /f /im epicgameslauncher.exe
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:1608
- C:\Windows\system32\taskkill.exe
  taskkill /f /im FortniteClient-Win64-Shipping_EAC.exe
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:460
- C:\Windows\system32\taskkill.exe
  taskkill /f /im FortniteClient-Win64-Shipping.exe
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:556
- C:\Windows\system32\taskkill.exe
  taskkill /f /im FortniteClient-Win64-Shipping_BE.exe
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:4468
- C:\Windows\system32\taskkill.exe
  taskkill /f /im FortniteLauncher.exe
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:4848
- C:\Windows\system32\taskkill.exe
  taskkill /f /im EpicGamesLauncher.exe
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:4636
- C:\Windows\system32\taskkill.exe
  taskkill /f /im FortniteClient-Win64-Shipping.exe
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:4592
- C:\Windows\system32\taskkill.exe
  taskkill /f /im EpicGamesLauncher.exe
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:4376
- C:\Windows\system32\taskkill.exe
  taskkill /f /im EasyAntiCheat_Setup.exe
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:4596
- C:\Windows\system32\taskkill.exe
  taskkill /f /im FortniteLauncher.exe
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:2968
- C:\Windows\system32\taskkill.exe
  taskkill /f /im EpicWebHelper.exe
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:3288
- C:\Windows\system32\taskkill.exe
  taskkill /f /im FortniteClient-Win64-Shipping.exe
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:4020
- C:\Windows\system32\taskkill.exe
  taskkill /f /im EasyAntiCheat.exe
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:3024
- C:\Windows\system32\taskkill.exe
  taskkill /f /im BEService_x64.exe
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:3392
- C:\Windows\system32\taskkill.exe
  taskkill /f /im EpicGamesLauncher.exe
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:5096
- C:\Windows\system32\taskkill.exe
  taskkill /f /im FortniteClient-Win64-Shipping_BE.exe
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:4896
- C:\Windows\system32\taskkill.exe
  taskkill /f /im FortniteClient-Win64-Shipping_EAC.exe
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:2504
- C:\Windows\system32\taskkill.exe
  taskkill /f /im smartscreen.exe
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:1632
- C:\Windows\system32\taskkill.exe
  taskkill /f /im EasyAntiCheat.exe
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:3576
- C:\Windows\system32\taskkill.exe
  taskkill /f /im dnf.exe
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:4280
- C:\Windows\system32\taskkill.exe
  taskkill /f /im DNF.exe
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:1672
- C:\Windows\system32\taskkill.exe
  taskkill /f /im CrossProxy.exe
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:2840
- C:\Windows\system32\taskkill.exe
  taskkill /f /im tensafe_1.exe
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:5072
- C:\Windows\system32\taskkill.exe
  taskkill /f /im TenSafe_1.exe
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:1652
- C:\Windows\system32\taskkill.exe
  taskkill /f /im tensafe_2.exe
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:2012
- C:\Windows\system32\taskkill.exe
  taskkill /f /im tencentdl.exe
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:2600
- C:\Windows\system32\taskkill.exe
  taskkill /f /im TenioDL.exe
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:2576
- C:\Windows\system32\taskkill.exe
  taskkill /f /im uishell.exe
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:2856
- C:\Windows\system32\taskkill.exe
  taskkill /f /im BackgroundDownloader.exe
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:2180
- C:\Windows\system32\taskkill.exe
  taskkill /f /im conime.exe
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:2640
- C:\Windows\system32\taskkill.exe
  taskkill /f /im QQDL.EXE
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:2348
- C:\Windows\system32\taskkill.exe
  taskkill /f /im qqlogin.exe
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:4644
- C:\Windows\system32\taskkill.exe
  taskkill /f /im dnfchina.exe
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:1184
- C:\Windows\system32\taskkill.exe
  taskkill /f /im dnfchinatest.exe
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:1072
- C:\Windows\system32\taskkill.exe
  taskkill /f /im dnf.exe
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:440
- C:\Windows\system32\taskkill.exe
  taskkill /f /im txplatform.exe
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:1292
- C:\Windows\system32\taskkill.exe
  taskkill /f /im TXPlatform.exe
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:3028
- C:\Windows\system32\taskkill.exe
  taskkill /f /im OriginWebHelperService.exe
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:3312
- C:\Windows\system32\taskkill.exe
  taskkill /f /im Origin.exe
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:3144
- C:\Windows\system32\taskkill.exe
  taskkill /f /im OriginClientService.exe
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:4092
- C:\Windows\system32\taskkill.exe
  taskkill /f /im OriginER.exe
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:1388
- C:\Windows\system32\taskkill.exe
  taskkill /f /im OriginThinSetupInternal.exe
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:2376
- C:\Windows\system32\taskkill.exe
  taskkill /f /im OriginLegacyCLI.exe
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:3852
- C:\Windows\system32\taskkill.exe
  taskkill /f /im Agent.exe
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:4864
- C:\Windows\system32\taskkill.exe
  taskkill /f /im Client.exe
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:4928
- C:\Windows\system32\sc.exe
  sc stop Steam
  2⤵
  - Launches sc.exe
  PID:4840
- C:\Windows\system32\sc.exe
  sc stop BEService
  2⤵
  - Launches sc.exe
  PID:4404
- C:\Windows\system32\sc.exe
  sc stop EasyAntiCheat
  2⤵
  - Launches sc.exe
  PID:760
- C:\Windows\system32\sc.exe
  sc stop PunkBuster
  2⤵
  - Launches sc.exe
  PID:3876
- C:\Windows\system32\sc.exe
  sc stop Vanguard
  2⤵
  - Launches sc.exe
  PID:4112
- C:\Windows\system32\sc.exe
  sc stop ricocheat
  2⤵
  - Launches sc.exe
  PID:2064
- C:\Windows\system32\sc.exe
  sc stop defender
  2⤵
  - Launches sc.exe
  PID:2988
- C:\Windows\system32\sc.exe
  sc stop firewall
  2⤵
  - Launches sc.exe
  PID:4228
- C:\Windows\system32\sc.exe
  sc stop explorer
  2⤵
  - Launches sc.exe
  PID:1712
- C:\Windows\system32\PING.EXE
  ping -n 1 google.com
  2⤵
  - Runs ping.exe
  PID:708
- C:\Windows\system32\netsh.exe
  netsh wlan connect name="your_wifi_network_name"
  2⤵
  PID:4592
- C:\Windows\system32\PING.EXE
  ping -n 1 google.com
  2⤵
  - Runs ping.exe
  PID:372
- C:\Windows\system32\ipconfig.exe
  ipconfig /all
  2⤵
  - Gathers network information
  PID:812