15ba48e43afbe0d0ba05d7befbfd4073c459d3335280c5885ecd2cb9f07b7970

Resubmissions

22-03-2024 00:33

240322-awglgsff8s 10

22-03-2024 00:29

240322-atdrtaff4z 8

22-03-2024 00:14

240322-ajp24afd9s 10

Analysis

max time kernel
1s
max time network
251s
platform
windows10-1703_x64
resource
win10-20240214-en
resource tags

arch:x64arch:x86image:win10-20240214-enlocale:en-usos:windows10-1703-x64system
submitted
22-03-2024 00:14

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

ggpermV3/macchanger.bat
Size

2KB
MD5

c0b8d81370dd4defc9317dc6c204d581
SHA1

fa2b6a292c398d2a2febbdddcf39a62ffbb6fb23
SHA256

4d8d40a7e435fc815d088d7309a6bece3a9d798b4fb8170ca3d9c4c7c8c6784f
SHA512

271552179a651414d8b321017a8675a1cd09ac83394cc014453d28f1837b60db657b1d75362af71d075b1f4e33ac5eedf6556a43709589a6159c4d0ef2d00828

Score

1^/10

Malware Config

Signatures

Suspicious use of AdjustPrivilegeToken 64 IoCs

Processes:

WMIC.exeWMIC.exe

description	pid	process
Token: SeIncreaseQuotaPrivilege	4404	WMIC.exe
Token: SeSecurityPrivilege	4404	WMIC.exe
Token: SeTakeOwnershipPrivilege	4404	WMIC.exe
Token: SeLoadDriverPrivilege	4404	WMIC.exe
Token: SeSystemProfilePrivilege	4404	WMIC.exe
Token: SeSystemtimePrivilege	4404	WMIC.exe
Token: SeProfSingleProcessPrivilege	4404	WMIC.exe
Token: SeIncBasePriorityPrivilege	4404	WMIC.exe
Token: SeCreatePagefilePrivilege	4404	WMIC.exe
Token: SeBackupPrivilege	4404	WMIC.exe
Token: SeRestorePrivilege	4404	WMIC.exe
Token: SeShutdownPrivilege	4404	WMIC.exe
Token: SeDebugPrivilege	4404	WMIC.exe
Token: SeSystemEnvironmentPrivilege	4404	WMIC.exe
Token: SeRemoteShutdownPrivilege	4404	WMIC.exe
Token: SeUndockPrivilege	4404	WMIC.exe
Token: SeManageVolumePrivilege	4404	WMIC.exe
Token: 33	4404	WMIC.exe
Token: 34	4404	WMIC.exe
Token: 35	4404	WMIC.exe
Token: 36	4404	WMIC.exe
Token: SeIncreaseQuotaPrivilege	4404	WMIC.exe
Token: SeSecurityPrivilege	4404	WMIC.exe
Token: SeTakeOwnershipPrivilege	4404	WMIC.exe
Token: SeLoadDriverPrivilege	4404	WMIC.exe
Token: SeSystemProfilePrivilege	4404	WMIC.exe
Token: SeSystemtimePrivilege	4404	WMIC.exe
Token: SeProfSingleProcessPrivilege	4404	WMIC.exe
Token: SeIncBasePriorityPrivilege	4404	WMIC.exe
Token: SeCreatePagefilePrivilege	4404	WMIC.exe
Token: SeBackupPrivilege	4404	WMIC.exe
Token: SeRestorePrivilege	4404	WMIC.exe
Token: SeShutdownPrivilege	4404	WMIC.exe
Token: SeDebugPrivilege	4404	WMIC.exe
Token: SeSystemEnvironmentPrivilege	4404	WMIC.exe
Token: SeRemoteShutdownPrivilege	4404	WMIC.exe
Token: SeUndockPrivilege	4404	WMIC.exe
Token: SeManageVolumePrivilege	4404	WMIC.exe
Token: 33	4404	WMIC.exe
Token: 34	4404	WMIC.exe
Token: 35	4404	WMIC.exe
Token: 36	4404	WMIC.exe
Token: SeIncreaseQuotaPrivilege	3356	WMIC.exe
Token: SeSecurityPrivilege	3356	WMIC.exe
Token: SeTakeOwnershipPrivilege	3356	WMIC.exe
Token: SeLoadDriverPrivilege	3356	WMIC.exe
Token: SeSystemProfilePrivilege	3356	WMIC.exe
Token: SeSystemtimePrivilege	3356	WMIC.exe
Token: SeProfSingleProcessPrivilege	3356	WMIC.exe
Token: SeIncBasePriorityPrivilege	3356	WMIC.exe
Token: SeCreatePagefilePrivilege	3356	WMIC.exe
Token: SeBackupPrivilege	3356	WMIC.exe
Token: SeRestorePrivilege	3356	WMIC.exe
Token: SeShutdownPrivilege	3356	WMIC.exe
Token: SeDebugPrivilege	3356	WMIC.exe
Token: SeSystemEnvironmentPrivilege	3356	WMIC.exe
Token: SeRemoteShutdownPrivilege	3356	WMIC.exe
Token: SeUndockPrivilege	3356	WMIC.exe
Token: SeManageVolumePrivilege	3356	WMIC.exe
Token: 33	3356	WMIC.exe
Token: 34	3356	WMIC.exe
Token: 35	3356	WMIC.exe
Token: 36	3356	WMIC.exe
Token: SeIncreaseQuotaPrivilege	3356	WMIC.exe

Suspicious use of WriteProcessMemory 64 IoCs

Processes:

cmd.execmd.execmd.execmd.exe

description	pid	process	target process
PID 212 wrote to memory of 4756	212	cmd.exe	cmd.exe
PID 212 wrote to memory of 4756	212	cmd.exe	cmd.exe
PID 4756 wrote to memory of 4404	4756	cmd.exe	WMIC.exe
PID 4756 wrote to memory of 4404	4756	cmd.exe	WMIC.exe
PID 4756 wrote to memory of 2980	4756	cmd.exe	findstr.exe
PID 4756 wrote to memory of 2980	4756	cmd.exe	findstr.exe
PID 212 wrote to memory of 768	212	cmd.exe	reg.exe
PID 212 wrote to memory of 768	212	cmd.exe	reg.exe
PID 212 wrote to memory of 1068	212	cmd.exe	reg.exe
PID 212 wrote to memory of 1068	212	cmd.exe	reg.exe
PID 212 wrote to memory of 684	212	cmd.exe	reg.exe
PID 212 wrote to memory of 684	212	cmd.exe	reg.exe
PID 212 wrote to memory of 3400	212	cmd.exe	reg.exe
PID 212 wrote to memory of 3400	212	cmd.exe	reg.exe
PID 212 wrote to memory of 200	212	cmd.exe	cmd.exe
PID 212 wrote to memory of 200	212	cmd.exe	cmd.exe
PID 200 wrote to memory of 3356	200	cmd.exe	WMIC.exe
PID 200 wrote to memory of 3356	200	cmd.exe	WMIC.exe
PID 200 wrote to memory of 4924	200	cmd.exe	findstr.exe
PID 200 wrote to memory of 4924	200	cmd.exe	findstr.exe
PID 212 wrote to memory of 4516	212	cmd.exe	reg.exe
PID 212 wrote to memory of 4516	212	cmd.exe	reg.exe
PID 212 wrote to memory of 4572	212	cmd.exe	reg.exe
PID 212 wrote to memory of 4572	212	cmd.exe	reg.exe
PID 212 wrote to memory of 3420	212	cmd.exe	reg.exe
PID 212 wrote to memory of 3420	212	cmd.exe	reg.exe
PID 212 wrote to memory of 2808	212	cmd.exe	reg.exe
PID 212 wrote to memory of 2808	212	cmd.exe	reg.exe
PID 212 wrote to memory of 520	212	cmd.exe	cmd.exe
PID 212 wrote to memory of 520	212	cmd.exe	cmd.exe
PID 520 wrote to memory of 2160	520	cmd.exe	WMIC.exe
PID 520 wrote to memory of 2160	520	cmd.exe	WMIC.exe
PID 212 wrote to memory of 4616	212	cmd.exe	netsh.exe
PID 212 wrote to memory of 4616	212	cmd.exe	netsh.exe
PID 212 wrote to memory of 4756	212	cmd.exe	cmd.exe
PID 212 wrote to memory of 4756	212	cmd.exe	cmd.exe
PID 4756 wrote to memory of 4404	4756	cmd.exe	WMIC.exe
PID 4756 wrote to memory of 4404	4756	cmd.exe	WMIC.exe
PID 4756 wrote to memory of 2980	4756	cmd.exe	findstr.exe
PID 4756 wrote to memory of 2980	4756	cmd.exe	findstr.exe
PID 212 wrote to memory of 768	212	cmd.exe	reg.exe
PID 212 wrote to memory of 768	212	cmd.exe	reg.exe
PID 212 wrote to memory of 1068	212	cmd.exe	reg.exe
PID 212 wrote to memory of 1068	212	cmd.exe	reg.exe
PID 212 wrote to memory of 684	212	cmd.exe	reg.exe
PID 212 wrote to memory of 684	212	cmd.exe	reg.exe
PID 212 wrote to memory of 3400	212	cmd.exe	reg.exe
PID 212 wrote to memory of 3400	212	cmd.exe	reg.exe
PID 212 wrote to memory of 200	212	cmd.exe	cmd.exe
PID 212 wrote to memory of 200	212	cmd.exe	cmd.exe
PID 200 wrote to memory of 3356	200	cmd.exe	WMIC.exe
PID 200 wrote to memory of 3356	200	cmd.exe	WMIC.exe
PID 200 wrote to memory of 4924	200	cmd.exe	findstr.exe
PID 200 wrote to memory of 4924	200	cmd.exe	findstr.exe
PID 212 wrote to memory of 4516	212	cmd.exe	reg.exe
PID 212 wrote to memory of 4516	212	cmd.exe	reg.exe
PID 212 wrote to memory of 4572	212	cmd.exe	reg.exe
PID 212 wrote to memory of 4572	212	cmd.exe	reg.exe
PID 212 wrote to memory of 3420	212	cmd.exe	reg.exe
PID 212 wrote to memory of 3420	212	cmd.exe	reg.exe
PID 212 wrote to memory of 2808	212	cmd.exe	reg.exe
PID 212 wrote to memory of 2808	212	cmd.exe	reg.exe
PID 212 wrote to memory of 520	212	cmd.exe	cmd.exe
PID 212 wrote to memory of 520	212	cmd.exe	cmd.exe

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\ggpermV3\macchanger.bat"
1⤵
- Suspicious use of WriteProcessMemory
PID:212
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c wmic nic where physicaladapter=true get deviceid | findstr [0-9]
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:4756
- - C:\Windows\System32\Wbem\WMIC.exe
    wmic nic where physicaladapter=true get deviceid
    3⤵
    - Suspicious use of AdjustPrivilegeToken
    PID:4404
- - C:\Windows\system32\findstr.exe
    findstr [0-9]
    3⤵
    PID:2980
- C:\Windows\system32\reg.exe
  REG QUERY HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Class\{4D36E972-E325-11CE-BFC1-08002bE10318}\01
  2⤵
  PID:768
- C:\Windows\system32\reg.exe
  REG QUERY HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Class\{4D36E972-E325-11CE-BFC1-08002bE10318}\001
  2⤵
  PID:1068
- C:\Windows\system32\reg.exe
  REG QUERY HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Class\{4D36E972-E325-11CE-BFC1-08002bE10318}\0001
  2⤵
  PID:684
- C:\Windows\system32\reg.exe
  REG ADD HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Class\{4D36E972-E325-11CE-BFC1-08002bE10318}\0001 /v NetworkAddress /t REG_SZ /d 0AAD1B6D2649 /f
  2⤵
  PID:3400
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c wmic nic where physicaladapter=true get deviceid | findstr [0-9]
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:200
- - C:\Windows\System32\Wbem\WMIC.exe
    wmic nic where physicaladapter=true get deviceid
    3⤵
    - Suspicious use of AdjustPrivilegeToken
    PID:3356
- - C:\Windows\system32\findstr.exe
    findstr [0-9]
    3⤵
    PID:4924
- C:\Windows\system32\reg.exe
  REG QUERY HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Class\{4D36E972-E325-11CE-BFC1-08002bE10318}\01
  2⤵
  PID:4516
- C:\Windows\system32\reg.exe
  REG QUERY HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Class\{4D36E972-E325-11CE-BFC1-08002bE10318}\001
  2⤵
  PID:4572
- C:\Windows\system32\reg.exe
  REG QUERY HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Class\{4D36E972-E325-11CE-BFC1-08002bE10318}\0001
  2⤵
  PID:3420
- C:\Windows\system32\reg.exe
  REG ADD HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Class\{4D36E972-E325-11CE-BFC1-08002bE10318}\0001 /v PnPCapabilities /t REG_DWORD /d 24 /f
  2⤵
  PID:2808
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c "wmic nic where (netconnectionid like '%') get netconnectionid,netconnectionstatus /format:csv"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:520
- - C:\Windows\System32\Wbem\WMIC.exe
    wmic nic where (netconnectionid like '%') get netconnectionid,netconnectionstatus /format:csv
    3⤵
    PID:2160
- C:\Windows\system32\netsh.exe
  netsh interface set interface name="Ethernet" disable
  2⤵
  PID:4616

\??\c:\windows\system32\svchost.exe
c:\windows\system32\svchost.exe -k localsystemnetworkrestricted -s Netman
1⤵
PID:3524

\??\c:\windows\system32\svchost.exe
c:\windows\system32\svchost.exe -k netsvcs -s NetSetupSvc
1⤵
PID:4548

Resubmissions

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads