Overview
overview
10Static
static
3Optimizer.rar
windows7-x64
3Optimizer.rar
windows10-2004-x64
3Optimizer/...ps.cmd
windows7-x64
1Optimizer/...ps.cmd
windows10-2004-x64
1Optimizer/...os.cmd
windows7-x64
8Optimizer/...os.cmd
windows10-2004-x64
8Optimizer/...01.bat
windows7-x64
7Optimizer/...01.bat
windows10-2004-x64
1Optimizer/...02.bat
windows7-x64
4Optimizer/...02.bat
windows10-2004-x64
1Optimizer/...S..bat
windows7-x64
7Optimizer/...S..bat
windows10-2004-x64
1Optimizer/... 2.bat
windows7-x64
1Optimizer/... 2.bat
windows10-2004-x64
1Optimizer/...AM.bat
windows7-x64
1Optimizer/...AM.bat
windows10-2004-x64
1Optimizer/...op.ini
windows7-x64
1Optimizer/...op.ini
windows10-2004-x64
1Optimizer/...ar.bat
windows7-x64
7Optimizer/...ar.bat
windows10-2004-x64
1Optimizer/...ct.exe
windows7-x64
6Optimizer/...ct.exe
windows10-2004-x64
8Optimizer/... 1.reg
windows7-x64
1Optimizer/... 1.reg
windows10-2004-x64
1Optimizer/...os.lnk
windows7-x64
3Optimizer/...os.lnk
windows10-2004-x64
3Optimizer/...te.bat
windows7-x64
10Optimizer/...te.bat
windows10-2004-x64
10Optimizer/...ca.bat
windows7-x64
7Optimizer/...ca.bat
windows10-2004-x64
1Optimizer/...�O.bat
windows7-x64
9Optimizer/...�O.bat
windows10-2004-x64
1Analysis
-
max time kernel
117s -
max time network
119s -
platform
windows7_x64 -
resource
win7-20240215-en -
resource tags
arch:x64arch:x86image:win7-20240215-enlocale:en-usos:windows7-x64system -
submitted
25-04-2024 21:44
Static task
static1
Behavioral task
behavioral1
Sample
Optimizer.rar
Resource
win7-20231129-en
Behavioral task
behavioral2
Sample
Optimizer.rar
Resource
win10v2004-20240412-en
Behavioral task
behavioral3
Sample
Optimizer/Pack Optimization/1. Otimizar Windows/+FPS/+fps.cmd
Resource
win7-20240221-en
Behavioral task
behavioral4
Sample
Optimizer/Pack Optimization/1. Otimizar Windows/+FPS/+fps.cmd
Resource
win10v2004-20240412-en
Behavioral task
behavioral5
Sample
Optimizer/Pack Optimization/1. Otimizar Windows/+FPS/Desabilitar Serviços.cmd
Resource
win7-20240221-en
Behavioral task
behavioral6
Sample
Optimizer/Pack Optimization/1. Otimizar Windows/+FPS/Desabilitar Serviços.cmd
Resource
win10v2004-20240412-en
Behavioral task
behavioral7
Sample
Optimizer/Pack Optimization/1. Otimizar Windows/+FPS/EXECUTAR APOS SEMPRE QUE LIGAR O PC/LIMPEZA 01.bat
Resource
win7-20240221-en
Behavioral task
behavioral8
Sample
Optimizer/Pack Optimization/1. Otimizar Windows/+FPS/EXECUTAR APOS SEMPRE QUE LIGAR O PC/LIMPEZA 01.bat
Resource
win10v2004-20240412-en
Behavioral task
behavioral9
Sample
Optimizer/Pack Optimization/1. Otimizar Windows/+FPS/EXECUTAR APOS SEMPRE QUE LIGAR O PC/LIMPEZA 02.bat
Resource
win7-20231129-en
Behavioral task
behavioral10
Sample
Optimizer/Pack Optimization/1. Otimizar Windows/+FPS/EXECUTAR APOS SEMPRE QUE LIGAR O PC/LIMPEZA 02.bat
Resource
win10v2004-20240412-en
Behavioral task
behavioral11
Sample
Optimizer/Pack Optimization/1. Otimizar Windows/+FPS/FPS..bat
Resource
win7-20240220-en
Behavioral task
behavioral12
Sample
Optimizer/Pack Optimization/1. Otimizar Windows/+FPS/FPS..bat
Resource
win10v2004-20240412-en
Behavioral task
behavioral13
Sample
Optimizer/Pack Optimization/1. Otimizar Windows/+FPS/Otimizar RAM 2.bat
Resource
win7-20240221-en
Behavioral task
behavioral14
Sample
Optimizer/Pack Optimization/1. Otimizar Windows/+FPS/Otimizar RAM 2.bat
Resource
win10v2004-20240412-en
Behavioral task
behavioral15
Sample
Optimizer/Pack Optimization/1. Otimizar Windows/+FPS/Otimizar RAM.bat
Resource
win7-20240221-en
Behavioral task
behavioral16
Sample
Optimizer/Pack Optimization/1. Otimizar Windows/+FPS/Otimizar RAM.bat
Resource
win10v2004-20240412-en
Behavioral task
behavioral17
Sample
Optimizer/Pack Optimization/1. Otimizar Windows/+FPS/desktop.ini
Resource
win7-20231129-en
Behavioral task
behavioral18
Sample
Optimizer/Pack Optimization/1. Otimizar Windows/+FPS/desktop.ini
Resource
win10v2004-20240412-en
Behavioral task
behavioral19
Sample
Optimizer/Pack Optimization/1. Otimizar Windows/+FPS/limpar.bat
Resource
win7-20240221-en
Behavioral task
behavioral20
Sample
Optimizer/Pack Optimization/1. Otimizar Windows/+FPS/limpar.bat
Resource
win10v2004-20240412-en
Behavioral task
behavioral21
Sample
Optimizer/Pack Optimization/1. Otimizar Windows/+FPS/memreduct.exe
Resource
win7-20240221-en
Behavioral task
behavioral22
Sample
Optimizer/Pack Optimization/1. Otimizar Windows/+FPS/memreduct.exe
Resource
win10v2004-20240412-en
Behavioral task
behavioral23
Sample
Optimizer/Pack Optimization/1. Otimizar Windows/01 Desativar DVR 1.reg
Resource
win7-20240221-en
Behavioral task
behavioral24
Sample
Optimizer/Pack Optimization/1. Otimizar Windows/01 Desativar DVR 1.reg
Resource
win10v2004-20240412-en
Behavioral task
behavioral25
Sample
Optimizer/Pack Optimization/1. Otimizar Windows/Deletar Arquivos Temporarios.lnk
Resource
win7-20240221-en
Behavioral task
behavioral26
Sample
Optimizer/Pack Optimization/1. Otimizar Windows/Deletar Arquivos Temporarios.lnk
Resource
win10v2004-20240412-en
Behavioral task
behavioral27
Sample
Optimizer/Pack Optimization/1. Otimizar Windows/Desativar windows update.bat
Resource
win7-20240215-en
Behavioral task
behavioral28
Sample
Optimizer/Pack Optimization/1. Otimizar Windows/Desativar windows update.bat
Resource
win10v2004-20240412-en
Behavioral task
behavioral29
Sample
Optimizer/Pack Optimization/1. Otimizar Windows/Limpeza automática.bat
Resource
win7-20240221-en
Behavioral task
behavioral30
Sample
Optimizer/Pack Optimization/1. Otimizar Windows/Limpeza automática.bat
Resource
win10v2004-20240226-en
Behavioral task
behavioral31
Sample
Optimizer/Pack Optimization/1. Otimizar Windows/OTIMIZAÇÂO.bat
Resource
win7-20240221-en
Behavioral task
behavioral32
Sample
Optimizer/Pack Optimization/1. Otimizar Windows/OTIMIZAÇÂO.bat
Resource
win10v2004-20240412-en
General
-
Target
Optimizer/Pack Optimization/1. Otimizar Windows/Desativar windows update.bat
-
Size
2KB
-
MD5
d587125749f254870fe3f571a777a1b6
-
SHA1
7d6845cf9930fc137c351f792196cbadf0a2627a
-
SHA256
6be454fca098998c5e44e5f59370b265f80fe7ac54bc9af59e665c747aaed3d9
-
SHA512
5eea06f6a9ba64fa5c839b196af2203036d686d46ba006746eb4ea1832ed0ac7045a84afd1387e98de425dcf3671d2809984d28ab22b1c53a3d879fc62bfaffa
Malware Config
Signatures
-
Modifies security service 2 TTPs 2 IoCs
Processes:
reg.exereg.exedescription ioc process Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\wuauserv\Start = "4" reg.exe Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\wuauserv\Start = "4" reg.exe -
Launches sc.exe 2 IoCs
Sc.exe is a Windows utlilty to control services on the system.
Processes:
sc.exesc.exepid process 2256 sc.exe 2056 sc.exe -
Suspicious use of WriteProcessMemory 63 IoCs
Processes:
cmd.exedescription pid process target process PID 2824 wrote to memory of 2256 2824 cmd.exe sc.exe PID 2824 wrote to memory of 2256 2824 cmd.exe sc.exe PID 2824 wrote to memory of 2256 2824 cmd.exe sc.exe PID 2824 wrote to memory of 2056 2824 cmd.exe sc.exe PID 2824 wrote to memory of 2056 2824 cmd.exe sc.exe PID 2824 wrote to memory of 2056 2824 cmd.exe sc.exe PID 2824 wrote to memory of 2084 2824 cmd.exe reg.exe PID 2824 wrote to memory of 2084 2824 cmd.exe reg.exe PID 2824 wrote to memory of 2084 2824 cmd.exe reg.exe PID 2824 wrote to memory of 1336 2824 cmd.exe reg.exe PID 2824 wrote to memory of 1336 2824 cmd.exe reg.exe PID 2824 wrote to memory of 1336 2824 cmd.exe reg.exe PID 2824 wrote to memory of 1996 2824 cmd.exe reg.exe PID 2824 wrote to memory of 1996 2824 cmd.exe reg.exe PID 2824 wrote to memory of 1996 2824 cmd.exe reg.exe PID 2824 wrote to memory of 2800 2824 cmd.exe reg.exe PID 2824 wrote to memory of 2800 2824 cmd.exe reg.exe PID 2824 wrote to memory of 2800 2824 cmd.exe reg.exe PID 2824 wrote to memory of 2872 2824 cmd.exe reg.exe PID 2824 wrote to memory of 2872 2824 cmd.exe reg.exe PID 2824 wrote to memory of 2872 2824 cmd.exe reg.exe PID 2824 wrote to memory of 2844 2824 cmd.exe reg.exe PID 2824 wrote to memory of 2844 2824 cmd.exe reg.exe PID 2824 wrote to memory of 2844 2824 cmd.exe reg.exe PID 2824 wrote to memory of 2208 2824 cmd.exe reg.exe PID 2824 wrote to memory of 2208 2824 cmd.exe reg.exe PID 2824 wrote to memory of 2208 2824 cmd.exe reg.exe PID 2824 wrote to memory of 2204 2824 cmd.exe reg.exe PID 2824 wrote to memory of 2204 2824 cmd.exe reg.exe PID 2824 wrote to memory of 2204 2824 cmd.exe reg.exe PID 2824 wrote to memory of 2828 2824 cmd.exe reg.exe PID 2824 wrote to memory of 2828 2824 cmd.exe reg.exe PID 2824 wrote to memory of 2828 2824 cmd.exe reg.exe PID 2824 wrote to memory of 1624 2824 cmd.exe reg.exe PID 2824 wrote to memory of 1624 2824 cmd.exe reg.exe PID 2824 wrote to memory of 1624 2824 cmd.exe reg.exe PID 2824 wrote to memory of 2680 2824 cmd.exe reg.exe PID 2824 wrote to memory of 2680 2824 cmd.exe reg.exe PID 2824 wrote to memory of 2680 2824 cmd.exe reg.exe PID 2824 wrote to memory of 2676 2824 cmd.exe reg.exe PID 2824 wrote to memory of 2676 2824 cmd.exe reg.exe PID 2824 wrote to memory of 2676 2824 cmd.exe reg.exe PID 2824 wrote to memory of 2500 2824 cmd.exe reg.exe PID 2824 wrote to memory of 2500 2824 cmd.exe reg.exe PID 2824 wrote to memory of 2500 2824 cmd.exe reg.exe PID 2824 wrote to memory of 2980 2824 cmd.exe reg.exe PID 2824 wrote to memory of 2980 2824 cmd.exe reg.exe PID 2824 wrote to memory of 2980 2824 cmd.exe reg.exe PID 2824 wrote to memory of 2932 2824 cmd.exe reg.exe PID 2824 wrote to memory of 2932 2824 cmd.exe reg.exe PID 2824 wrote to memory of 2932 2824 cmd.exe reg.exe PID 2824 wrote to memory of 2516 2824 cmd.exe reg.exe PID 2824 wrote to memory of 2516 2824 cmd.exe reg.exe PID 2824 wrote to memory of 2516 2824 cmd.exe reg.exe PID 2824 wrote to memory of 2536 2824 cmd.exe reg.exe PID 2824 wrote to memory of 2536 2824 cmd.exe reg.exe PID 2824 wrote to memory of 2536 2824 cmd.exe reg.exe PID 2824 wrote to memory of 2556 2824 cmd.exe reg.exe PID 2824 wrote to memory of 2556 2824 cmd.exe reg.exe PID 2824 wrote to memory of 2556 2824 cmd.exe reg.exe PID 2824 wrote to memory of 2600 2824 cmd.exe reg.exe PID 2824 wrote to memory of 2600 2824 cmd.exe reg.exe PID 2824 wrote to memory of 2600 2824 cmd.exe reg.exe
Processes
-
C:\Windows\system32\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\Optimizer\Pack Optimization\1. Otimizar Windows\Desativar windows update.bat"1⤵
- Suspicious use of WriteProcessMemory
PID:2824 -
C:\Windows\system32\sc.exesc config "UsoSvc" start=disabled2⤵
- Launches sc.exe
PID:2256 -
C:\Windows\system32\sc.exesc config "wuauserv" start=disabled2⤵
- Launches sc.exe
PID:2056 -
C:\Windows\system32\reg.exeReg.exe add "HKLM\SYSTEM\ControlSet001\Services\wuauserv" /v "Start" /t REG_DWORD /d "4" /f2⤵
- Modifies security service
PID:2084 -
C:\Windows\system32\reg.exeReg.exe add "HKLM\SYSTEM\CurrentControlSet\Services\wuauserv" /v "Start" /t REG_DWORD /d "4" /f2⤵
- Modifies security service
PID:1336 -
C:\Windows\system32\reg.exeReg.exe add "HKLM\SOFTWARE\Wow6432Node\Policies\Microsoft\Windows\WindowsUpdate\AU" /v "NoAutoUpdate" /t REG_DWORD /d "1" /f2⤵PID:1996
-
C:\Windows\system32\reg.exeReg.exe add "HKLM\SOFTWARE\Wow6432Node\Policies\Microsoft\Windows\WindowsUpdate\AU" /v "AUOptions" /t REG_DWORD /d "2" /f2⤵PID:2800
-
C:\Windows\system32\reg.exeReg.exe add "HKLM\SOFTWARE\Wow6432Node\Policies\Microsoft\Windows\WindowsUpdate\AU" /v "ScheduledInstallDay" /t REG_DWORD /d "0" /f2⤵PID:2872
-
C:\Windows\system32\reg.exeReg.exe add "HKLM\SOFTWARE\Wow6432Node\Policies\Microsoft\Windows\WindowsUpdate\AU" /v "ScheduledInstallTime" /t REG_DWORD /d "3" /f2⤵PID:2844
-
C:\Windows\system32\reg.exeReg.exe add "HKLM\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate\AU" /v "NoAutoRebootWithLoggedOnUsers" /t REG_DWORD /d "1" /f2⤵PID:2208
-
C:\Windows\system32\reg.exeReg.exe add "HKLM\SOFTWARE\Policies\Microsoft\Windows\DeliveryOptimization" /v "DODownloadMode" /t REG_DWORD /d "0" /f2⤵PID:2204
-
C:\Windows\system32\reg.exeReg.exe add "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Config" /v "DODownloadMode" /t REG_DWORD /d "0" /f2⤵PID:2828
-
C:\Windows\system32\reg.exeReg.exe add "HKLM\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate" /v "DeferUpgrade" /t REG_DWORD /d "1" /f2⤵PID:1624
-
C:\Windows\system32\reg.exeReg.exe add "HKLM\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate" /v "DeferUpgradePeriod" /t REG_DWORD /d "1" /f2⤵PID:2680
-
C:\Windows\system32\reg.exeReg.exe add "HKLM\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate" /v "DeferUpdatePeriod" /t REG_DWORD /d "0" /f2⤵PID:2676
-
C:\Windows\system32\reg.exeReg.exe add "HKLM\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate\UX\Settings" /v "DeferUpgrade" /t REG_DWORD /d "0" /f2⤵PID:2500
-
C:\Windows\system32\reg.exeReg.exe add "HKCU\Software\Microsoft\Windows\CurrentVersion\DeliveryOptimization" /v "SystemSettingsDownloadMode" /t REG_DWORD /d "0" /f2⤵PID:2980
-
C:\Windows\system32\reg.exeReg.exe add "HKLM\SOFTWARE\Policies\Microsoft\Speech" /v "AllowSpeechModelUpdate" /t REG_DWORD /d "0" /f2⤵PID:2932
-
C:\Windows\system32\reg.exeReg.exe add "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Device Metadata" /v "PreventDeviceMetadataFromNetwork" /t REG_DWORD /d "1" /f2⤵PID:2516
-
C:\Windows\system32\reg.exeReg.exe add "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\WindowsStore\WindowsUpdate" /v "AutoDownload" /t REG_DWORD /d "2" /f2⤵PID:2536
-
C:\Windows\system32\reg.exeReg.exe add "HKLM\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate\AU" /v "NoAutoUpdate" /t REG_DWORD /d "1" /f2⤵PID:2556
-
C:\Windows\system32\reg.exeReg.exe add "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\WindowsUpdate\Services\7971f918-a847-4430-9279-4a52d1efe18d" /v "RegisteredWithAU" /t REG_DWORD /d "0" /f2⤵PID:2600