4392461d55c1d6c71b95d8b92b544c8c3260c3e9cfe76f56507b4ac15d8bcad1

Resubmissions

19-04-2024 11:45

240419-nw88dsag38 10

19-04-2024 11:43

240419-nv23pabf2x 3

19-04-2024 10:25

240419-mf6a5agh7t 10

Analysis

max time kernel
122s
max time network
127s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
19-04-2024 10:25

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

infinite locker.bat
Size

1KB
MD5

ee64ffe8afb7ae50a94654b29b18e805
SHA1

845b1d1841eaebc4cf87f796ff272595b82b0a99
SHA256

0c2401442ccedb4cecb194044cd5c8893ae44ad84f549c4d9007a78153e26f40
SHA512

22bad3b85221af74cb931a6e358c6eb11ede54536c0bdf6a1f848589981a4608e4c2e41bf348fbbc3390026f206a6fcf899ea2877d19a402169e801bd3ec103b

Score

7^/10

discovery

Malware Config

Signatures

Deletes itself 1 IoCs

pid	Process
1644	cmd.exe

Modifies file permissions 1 TTPs 1 IoCs

discovery

File and Directory Permissions Modification

T1222

pid	Process
2624	takeown.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeTakeOwnershipPrivilege	2624	takeown.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 1644 wrote to memory of 2624	1644	cmd.exe	29
PID 1644 wrote to memory of 2624	1644	cmd.exe	29
PID 1644 wrote to memory of 2624	1644	cmd.exe	29

C:\Windows\system32\cmd.exe
cmd /c "C:\Users\Admin\AppData\Local\Temp\infinite locker.bat"
1⤵
- Deletes itself
- Suspicious use of WriteProcessMemory
PID:1644
- C:\Windows\system32\takeown.exe
  takeown /f C:\Windows\System32
  2⤵
  - Modifies file permissions
  - Suspicious use of AdjustPrivilegeToken
  PID:2624

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

File and Directory Permissions Modification

T1222

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Resubmissions

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads