Analysis
-
max time kernel
127s -
max time network
132s -
platform
windows10-1703_x64 -
resource
win10-20240319-en -
resource tags
arch:x64arch:x86image:win10-20240319-enlocale:en-usos:windows10-1703-x64system -
submitted
15/04/2024, 11:02
Static task
static1
Behavioral task
behavioral1
Sample
Infinitycrash.bat
Resource
win10-20240319-en
windows10-1703-x64
8 signatures
150 seconds
General
-
Target
Infinitycrash.bat
-
Size
363B
-
MD5
b31cb5cb824da4d9b935fa908d002b34
-
SHA1
0e743230273dd0390dc9f3f0b59f4a64c88bccd0
-
SHA256
2d3350d5efeed9d0f2d50ea39fdc4824cfc452594aaa621d730249ca65ded1f3
-
SHA512
16d668b73e49c11e321de2b5d0a9f50d0da59268f909d44df5573f06494a1f9f27c6d2f7c72b07e8bd7cc2e606aa5df8966a5fb438ec0bb647a234272f74a174
Score
4/10
Malware Config
Signatures
-
Drops file in Windows directory 2 IoCs
description ioc Process File created C:\Windows\rescache\_merged\4183903823\2290032291.pri taskmgr.exe File created C:\Windows\rescache\_merged\1601268389\715946058.pri taskmgr.exe -
Checks SCSI registry key(s) 3 TTPs 3 IoCs
SCSI information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_QEMU&Prod_HARDDISK\4&215468a5&0&000000 taskmgr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_QEMU&Prod_HARDDISK\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A taskmgr.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_QEMU&Prod_HARDDISK\4&215468a5&0&000000\FriendlyName taskmgr.exe -
Suspicious behavior: EnumeratesProcesses 13 IoCs
pid Process 1644 taskmgr.exe 1644 taskmgr.exe 1644 taskmgr.exe 1644 taskmgr.exe 1644 taskmgr.exe 1644 taskmgr.exe 1644 taskmgr.exe 1644 taskmgr.exe 1644 taskmgr.exe 1644 taskmgr.exe 1644 taskmgr.exe 1644 taskmgr.exe 1644 taskmgr.exe -
Suspicious use of AdjustPrivilegeToken 9 IoCs
description pid Process Token: 33 4104 AUDIODG.EXE Token: SeIncBasePriorityPrivilege 4104 AUDIODG.EXE Token: SeTcbPrivilege 4464 svchost.exe Token: SeRestorePrivilege 4464 svchost.exe Token: SeDebugPrivilege 1644 taskmgr.exe Token: SeSystemProfilePrivilege 1644 taskmgr.exe Token: SeCreateGlobalPrivilege 1644 taskmgr.exe Token: 33 1644 taskmgr.exe Token: SeIncBasePriorityPrivilege 1644 taskmgr.exe -
Suspicious use of FindShellTrayWindow 39 IoCs
pid Process 1644 taskmgr.exe 1644 taskmgr.exe 1644 taskmgr.exe 1644 taskmgr.exe 1644 taskmgr.exe 1644 taskmgr.exe 1644 taskmgr.exe 1644 taskmgr.exe 1644 taskmgr.exe 1644 taskmgr.exe 1644 taskmgr.exe 1644 taskmgr.exe 1644 taskmgr.exe 1644 taskmgr.exe 1644 taskmgr.exe 1644 taskmgr.exe 1644 taskmgr.exe 1644 taskmgr.exe 1644 taskmgr.exe 1644 taskmgr.exe 1644 taskmgr.exe 1644 taskmgr.exe 1644 taskmgr.exe 1644 taskmgr.exe 1644 taskmgr.exe 1644 taskmgr.exe 1644 taskmgr.exe 1644 taskmgr.exe 1644 taskmgr.exe 1644 taskmgr.exe 1644 taskmgr.exe 1644 taskmgr.exe 1644 taskmgr.exe 1644 taskmgr.exe 1644 taskmgr.exe 1644 taskmgr.exe 1644 taskmgr.exe 1644 taskmgr.exe 1644 taskmgr.exe -
Suspicious use of SendNotifyMessage 39 IoCs
pid Process 1644 taskmgr.exe 1644 taskmgr.exe 1644 taskmgr.exe 1644 taskmgr.exe 1644 taskmgr.exe 1644 taskmgr.exe 1644 taskmgr.exe 1644 taskmgr.exe 1644 taskmgr.exe 1644 taskmgr.exe 1644 taskmgr.exe 1644 taskmgr.exe 1644 taskmgr.exe 1644 taskmgr.exe 1644 taskmgr.exe 1644 taskmgr.exe 1644 taskmgr.exe 1644 taskmgr.exe 1644 taskmgr.exe 1644 taskmgr.exe 1644 taskmgr.exe 1644 taskmgr.exe 1644 taskmgr.exe 1644 taskmgr.exe 1644 taskmgr.exe 1644 taskmgr.exe 1644 taskmgr.exe 1644 taskmgr.exe 1644 taskmgr.exe 1644 taskmgr.exe 1644 taskmgr.exe 1644 taskmgr.exe 1644 taskmgr.exe 1644 taskmgr.exe 1644 taskmgr.exe 1644 taskmgr.exe 1644 taskmgr.exe 1644 taskmgr.exe 1644 taskmgr.exe -
Suspicious use of WriteProcessMemory 10 IoCs
description pid Process procid_target PID 2852 wrote to memory of 392 2852 cmd.exe 73 PID 2852 wrote to memory of 392 2852 cmd.exe 73 PID 2852 wrote to memory of 1436 2852 cmd.exe 74 PID 2852 wrote to memory of 1436 2852 cmd.exe 74 PID 2852 wrote to memory of 2920 2852 cmd.exe 75 PID 2852 wrote to memory of 2920 2852 cmd.exe 75 PID 2852 wrote to memory of 208 2852 cmd.exe 76 PID 2852 wrote to memory of 208 2852 cmd.exe 76 PID 4464 wrote to memory of 3368 4464 svchost.exe 79 PID 4464 wrote to memory of 3368 4464 svchost.exe 79 -
Views/modifies file attributes 1 TTPs 4 IoCs
pid Process 392 attrib.exe 1436 attrib.exe 2920 attrib.exe 208 attrib.exe
Processes
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\Infinitycrash.bat"1⤵
- Suspicious use of WriteProcessMemory
PID:2852 -
C:\Windows\system32\attrib.exeattrib -r -s -h c:autoexec.bat2⤵
- Views/modifies file attributes
PID:392
-
-
C:\Windows\system32\attrib.exeattrib -r -s -h c:boot.ini2⤵
- Views/modifies file attributes
PID:1436
-
-
C:\Windows\system32\attrib.exeattrib -r -s -h c:ntldr2⤵
- Views/modifies file attributes
PID:2920
-
-
C:\Windows\system32\attrib.exeattrib -r -s -h c:windowswin.ini2⤵
- Views/modifies file attributes
PID:208
-
-
C:\Windows\system32\AUDIODG.EXEC:\Windows\system32\AUDIODG.EXE 0x3e81⤵
- Suspicious use of AdjustPrivilegeToken
PID:4104
-
\??\c:\windows\system32\svchost.exec:\windows\system32\svchost.exe -k localsystemnetworkrestricted -s DeviceAssociationService1⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4464 -
C:\Windows\system32\dashost.exedashost.exe {ae46e400-f4ea-4b0d-8b7bf0ace4f7882d}2⤵PID:3368
-
-
C:\Windows\system32\taskmgr.exe"C:\Windows\system32\taskmgr.exe" /41⤵
- Drops file in Windows directory
- Checks SCSI registry key(s)
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:1644