15ba48e43afbe0d0ba05d7befbfd4073c459d3335280c5885ecd2cb9f07b7970

Resubmissions

22-03-2024 00:33

22-03-2024 00:29

22-03-2024 00:14

max time kernel
219s
max time network
300s
platform
windows10-1703_x64
resource
win10-20240221-en
resource tags

arch:x64arch:x86image:win10-20240221-enlocale:en-usos:windows10-1703-x64system
submitted
22-03-2024 00:14

Target

ggpermV3/Final_Cleaner.bat
Size

107KB
MD5

98f1a0eebcb5f4798662a40323b05a7e
SHA1

068e288005c04b8d859c44d3767613a8036bdb11
SHA256

00023ce602db623e47de1029595339eec4ee5019c6017236c9b721cac0ae4032
SHA512

6cfda16ce56b1173b91bd86c0f977f022a0b01a77142a15f66d865ee3f00ffee6aa2df7571edcccac41f7d680a9c4c536991abd91e86a00b083b8f9f37a39cf7
SSDEEP

768:S/KZzmezF/svUsfg8gVhCBL1oPYdxCA1n5xpoL8oPlRPrPEPupL5LvLpLjLgwJyo:Kg8gUDRnvplQL5LvLpLjLnn

Score

1^/10

Kills process with taskkill 5 IoCs
evasion

Processes:

taskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exe

pid process

4432 taskkill.exe
1540 taskkill.exe
3076 taskkill.exe
3992 taskkill.exe
1364 taskkill.exe

Suspicious use of AdjustPrivilegeToken 5 IoCs

Processes:

taskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exe

Suspicious use of WriteProcessMemory 14 IoCs

Processes:

cmd.execmd.exe

description	pid	process	target process
PID 4076 wrote to memory of 4432	4076	cmd.exe	taskkill.exe
PID 4076 wrote to memory of 4432	4076	cmd.exe	taskkill.exe
PID 4076 wrote to memory of 1540	4076	cmd.exe	taskkill.exe
PID 4076 wrote to memory of 1540	4076	cmd.exe	taskkill.exe
PID 4076 wrote to memory of 3076	4076	cmd.exe	taskkill.exe
PID 4076 wrote to memory of 3076	4076	cmd.exe	taskkill.exe
PID 4076 wrote to memory of 3992	4076	cmd.exe	taskkill.exe
PID 4076 wrote to memory of 3992	4076	cmd.exe	taskkill.exe
PID 4076 wrote to memory of 1364	4076	cmd.exe	taskkill.exe
PID 4076 wrote to memory of 1364	4076	cmd.exe	taskkill.exe
PID 4076 wrote to memory of 4788	4076	cmd.exe	cmd.exe
PID 4076 wrote to memory of 4788	4076	cmd.exe	cmd.exe
PID 4788 wrote to memory of 864	4788	cmd.exe	findstr.exe
PID 4788 wrote to memory of 864	4788	cmd.exe	findstr.exe

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\ggpermV3\Final_Cleaner.bat"
1⤵
- Suspicious use of WriteProcessMemory
PID:4076
- C:\Windows\system32\taskkill.exe
  taskkill /f /im FortniteClient-Win64-Shipping_EAC.exe
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:4432
- C:\Windows\system32\taskkill.exe
  taskkill /f /im FortniteClient-Win64-Shipping.exe
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:1540
- C:\Windows\system32\taskkill.exe
  taskkill /f /im FortniteClient-Win64-Shipping_BE.exe
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:3076
- C:\Windows\system32\taskkill.exe
  taskkill /f /im FortniteLauncher.exe
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:3992
- C:\Windows\system32\taskkill.exe
  taskkill /f /im EpicGamesLauncher.exe
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:1364
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c findstr /b ::: "C:\Users\Admin\AppData\Local\Temp\ggpermV3\Final_Cleaner.bat"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:4788
- - C:\Windows\system32\findstr.exe
    findstr /b ::: "C:\Users\Admin\AppData\Local\Temp\ggpermV3\Final_Cleaner.bat"
    3⤵
    PID:864