4dd389365d0d92f355a4983ab551bcf6f3ed4fc4eb969f6f520fd6834629a44f

Analysis

max time kernel
0s
platform
windows11-21h2_x64
resource
win11-20240221-en
resource tags

arch:x64arch:x86image:win11-20240221-enlocale:en-usos:windows11-21h2-x64system
submitted
27-03-2024 15:11

Target

startup.bat
Size

1KB
MD5

d72c6769af285d64eece5e74c8b75ac9
SHA1

9af83578ed0ed0ddd133af44b0352d1416d95bf6
SHA256

203bd31174435038272e91dabec16150b4029562904cfb4e4b0267be83af912c
SHA512

416831a336fd8bc2f9a2305bdb4ea8a115d7c4fb9037b069633fc6d33801afb7803f5e6f91300a5055ec9c80125ccaa00e151c82c9dd11aa6cc4904df245c189

Score

1^/10

Kills process with taskkill 1 IoCs

evasion

pid	Process
4896	taskkill.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	4896	taskkill.exe

Suspicious use of WriteProcessMemory 6 IoCs

description	pid	Process	procid_target
PID 3004 wrote to memory of 2016	3004	cmd.exe	79
PID 3004 wrote to memory of 2016	3004	cmd.exe	79
PID 2016 wrote to memory of 4972	2016	net.exe	80
PID 2016 wrote to memory of 4972	2016	net.exe	80
PID 3004 wrote to memory of 4896	3004	cmd.exe	81
PID 3004 wrote to memory of 4896	3004	cmd.exe	81

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\startup.bat"
1⤵
- Suspicious use of WriteProcessMemory
PID:3004
- C:\Windows\system32\net.exe
  NET FILE
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2016
- - C:\Windows\system32\net1.exe
    C:\Windows\system32\net1 FILE
    3⤵
    PID:4972
- C:\Windows\system32\taskkill.exe
  taskkill /f /im svchost.exe
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:4896