8ee557ebd3b08beb47d88321d3f426679f63c807785ff84ddb039f63e1fb7287

Analysis

max time kernel
119s
max time network
130s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
25-04-2024 21:44

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

Optimizer/Pack Optimization/1. Otimizar Windows/+FPS/Desabilitar Serviços.cmd
Size

1KB
MD5

883d6b95f1dd95e5a17febc03735152e
SHA1

23c76b6bbd615934d309c0f6df0161a2dd8f19a6
SHA256

f0c263cba371d8655ce5b551bbfe36ea5f9991baf204a7be428d5c483eac3b88
SHA512

23bd52aaf707f542da4f2262a0ba0f161ffaa853241c5b27c9f377f81f1d50e64a6ff84c6a6db31702ef9fb4ffef532da4ee9032fc1f7bd173ffadeb1f0b60a0

Score

8^/10

evasion

Malware Config

Signatures

Stops running service(s) 3 TTPs
evasion

Windows Service
T1543.003

Impair Defenses
T1562

Service Stop
T1489
Launches sc.exe 12 IoCs
Sc.exe is a Windows utlilty to control services on the system.

Processes:

sc.exesc.exesc.exesc.exesc.exesc.exesc.exesc.exesc.exesc.exesc.exesc.exe

pid process

2380 sc.exe
576 sc.exe
536 sc.exe
2548 sc.exe
2700 sc.exe
2340 sc.exe
2364 sc.exe
2188 sc.exe
324 sc.exe
904 sc.exe
1840 sc.exe
3064 sc.exe

pid	process
2380	sc.exe
576	sc.exe
536	sc.exe
2548	sc.exe
2700	sc.exe
2340	sc.exe
2364	sc.exe
2188	sc.exe
324	sc.exe
904	sc.exe
1840	sc.exe
3064	sc.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

Processes:

WMIC.exeWMIC.exe

description	pid	process
Token: SeIncreaseQuotaPrivilege	2052	WMIC.exe
Token: SeSecurityPrivilege	2052	WMIC.exe
Token: SeTakeOwnershipPrivilege	2052	WMIC.exe
Token: SeLoadDriverPrivilege	2052	WMIC.exe
Token: SeSystemProfilePrivilege	2052	WMIC.exe
Token: SeSystemtimePrivilege	2052	WMIC.exe
Token: SeProfSingleProcessPrivilege	2052	WMIC.exe
Token: SeIncBasePriorityPrivilege	2052	WMIC.exe
Token: SeCreatePagefilePrivilege	2052	WMIC.exe
Token: SeBackupPrivilege	2052	WMIC.exe
Token: SeRestorePrivilege	2052	WMIC.exe
Token: SeShutdownPrivilege	2052	WMIC.exe
Token: SeDebugPrivilege	2052	WMIC.exe
Token: SeSystemEnvironmentPrivilege	2052	WMIC.exe
Token: SeRemoteShutdownPrivilege	2052	WMIC.exe
Token: SeUndockPrivilege	2052	WMIC.exe
Token: SeManageVolumePrivilege	2052	WMIC.exe
Token: 33	2052	WMIC.exe
Token: 34	2052	WMIC.exe
Token: 35	2052	WMIC.exe
Token: SeIncreaseQuotaPrivilege	2052	WMIC.exe
Token: SeSecurityPrivilege	2052	WMIC.exe
Token: SeTakeOwnershipPrivilege	2052	WMIC.exe
Token: SeLoadDriverPrivilege	2052	WMIC.exe
Token: SeSystemProfilePrivilege	2052	WMIC.exe
Token: SeSystemtimePrivilege	2052	WMIC.exe
Token: SeProfSingleProcessPrivilege	2052	WMIC.exe
Token: SeIncBasePriorityPrivilege	2052	WMIC.exe
Token: SeCreatePagefilePrivilege	2052	WMIC.exe
Token: SeBackupPrivilege	2052	WMIC.exe
Token: SeRestorePrivilege	2052	WMIC.exe
Token: SeShutdownPrivilege	2052	WMIC.exe
Token: SeDebugPrivilege	2052	WMIC.exe
Token: SeSystemEnvironmentPrivilege	2052	WMIC.exe
Token: SeRemoteShutdownPrivilege	2052	WMIC.exe
Token: SeUndockPrivilege	2052	WMIC.exe
Token: SeManageVolumePrivilege	2052	WMIC.exe
Token: 33	2052	WMIC.exe
Token: 34	2052	WMIC.exe
Token: 35	2052	WMIC.exe
Token: SeIncreaseQuotaPrivilege	2524	WMIC.exe
Token: SeSecurityPrivilege	2524	WMIC.exe
Token: SeTakeOwnershipPrivilege	2524	WMIC.exe
Token: SeLoadDriverPrivilege	2524	WMIC.exe
Token: SeSystemProfilePrivilege	2524	WMIC.exe
Token: SeSystemtimePrivilege	2524	WMIC.exe
Token: SeProfSingleProcessPrivilege	2524	WMIC.exe
Token: SeIncBasePriorityPrivilege	2524	WMIC.exe
Token: SeCreatePagefilePrivilege	2524	WMIC.exe
Token: SeBackupPrivilege	2524	WMIC.exe
Token: SeRestorePrivilege	2524	WMIC.exe
Token: SeShutdownPrivilege	2524	WMIC.exe
Token: SeDebugPrivilege	2524	WMIC.exe
Token: SeSystemEnvironmentPrivilege	2524	WMIC.exe
Token: SeRemoteShutdownPrivilege	2524	WMIC.exe
Token: SeUndockPrivilege	2524	WMIC.exe
Token: SeManageVolumePrivilege	2524	WMIC.exe
Token: 33	2524	WMIC.exe
Token: 34	2524	WMIC.exe
Token: 35	2524	WMIC.exe
Token: SeIncreaseQuotaPrivilege	2524	WMIC.exe
Token: SeSecurityPrivilege	2524	WMIC.exe
Token: SeTakeOwnershipPrivilege	2524	WMIC.exe
Token: SeLoadDriverPrivilege	2524	WMIC.exe

Suspicious use of WriteProcessMemory 64 IoCs

Processes:

cmd.exe

description	pid	process	target process
PID 2812 wrote to memory of 2052	2812	cmd.exe	WMIC.exe
PID 2812 wrote to memory of 2052	2812	cmd.exe	WMIC.exe
PID 2812 wrote to memory of 2052	2812	cmd.exe	WMIC.exe
PID 2812 wrote to memory of 3064	2812	cmd.exe	sc.exe
PID 2812 wrote to memory of 3064	2812	cmd.exe	sc.exe
PID 2812 wrote to memory of 3064	2812	cmd.exe	sc.exe
PID 2812 wrote to memory of 2524	2812	cmd.exe	WMIC.exe
PID 2812 wrote to memory of 2524	2812	cmd.exe	WMIC.exe
PID 2812 wrote to memory of 2524	2812	cmd.exe	WMIC.exe
PID 2812 wrote to memory of 2700	2812	cmd.exe	sc.exe
PID 2812 wrote to memory of 2700	2812	cmd.exe	sc.exe
PID 2812 wrote to memory of 2700	2812	cmd.exe	sc.exe
PID 2812 wrote to memory of 2460	2812	cmd.exe	WMIC.exe
PID 2812 wrote to memory of 2460	2812	cmd.exe	WMIC.exe
PID 2812 wrote to memory of 2460	2812	cmd.exe	WMIC.exe
PID 2812 wrote to memory of 2340	2812	cmd.exe	sc.exe
PID 2812 wrote to memory of 2340	2812	cmd.exe	sc.exe
PID 2812 wrote to memory of 2340	2812	cmd.exe	sc.exe
PID 2812 wrote to memory of 2516	2812	cmd.exe	WMIC.exe
PID 2812 wrote to memory of 2516	2812	cmd.exe	WMIC.exe
PID 2812 wrote to memory of 2516	2812	cmd.exe	WMIC.exe
PID 2812 wrote to memory of 2548	2812	cmd.exe	sc.exe
PID 2812 wrote to memory of 2548	2812	cmd.exe	sc.exe
PID 2812 wrote to memory of 2548	2812	cmd.exe	sc.exe
PID 2812 wrote to memory of 2556	2812	cmd.exe	WMIC.exe
PID 2812 wrote to memory of 2556	2812	cmd.exe	WMIC.exe
PID 2812 wrote to memory of 2556	2812	cmd.exe	WMIC.exe
PID 2812 wrote to memory of 2380	2812	cmd.exe	sc.exe
PID 2812 wrote to memory of 2380	2812	cmd.exe	sc.exe
PID 2812 wrote to memory of 2380	2812	cmd.exe	sc.exe
PID 2812 wrote to memory of 2392	2812	cmd.exe	WMIC.exe
PID 2812 wrote to memory of 2392	2812	cmd.exe	WMIC.exe
PID 2812 wrote to memory of 2392	2812	cmd.exe	WMIC.exe
PID 2812 wrote to memory of 2364	2812	cmd.exe	sc.exe
PID 2812 wrote to memory of 2364	2812	cmd.exe	sc.exe
PID 2812 wrote to memory of 2364	2812	cmd.exe	sc.exe
PID 2812 wrote to memory of 2408	2812	cmd.exe	WMIC.exe
PID 2812 wrote to memory of 2408	2812	cmd.exe	WMIC.exe
PID 2812 wrote to memory of 2408	2812	cmd.exe	WMIC.exe
PID 2812 wrote to memory of 2188	2812	cmd.exe	sc.exe
PID 2812 wrote to memory of 2188	2812	cmd.exe	sc.exe
PID 2812 wrote to memory of 2188	2812	cmd.exe	sc.exe
PID 2812 wrote to memory of 1856	2812	cmd.exe	WMIC.exe
PID 2812 wrote to memory of 1856	2812	cmd.exe	WMIC.exe
PID 2812 wrote to memory of 1856	2812	cmd.exe	WMIC.exe
PID 2812 wrote to memory of 324	2812	cmd.exe	sc.exe
PID 2812 wrote to memory of 324	2812	cmd.exe	sc.exe
PID 2812 wrote to memory of 324	2812	cmd.exe	sc.exe
PID 2812 wrote to memory of 2316	2812	cmd.exe	WMIC.exe
PID 2812 wrote to memory of 2316	2812	cmd.exe	WMIC.exe
PID 2812 wrote to memory of 2316	2812	cmd.exe	WMIC.exe
PID 2812 wrote to memory of 576	2812	cmd.exe	sc.exe
PID 2812 wrote to memory of 576	2812	cmd.exe	sc.exe
PID 2812 wrote to memory of 576	2812	cmd.exe	sc.exe
PID 2812 wrote to memory of 812	2812	cmd.exe	WMIC.exe
PID 2812 wrote to memory of 812	2812	cmd.exe	WMIC.exe
PID 2812 wrote to memory of 812	2812	cmd.exe	WMIC.exe
PID 2812 wrote to memory of 904	2812	cmd.exe	sc.exe
PID 2812 wrote to memory of 904	2812	cmd.exe	sc.exe
PID 2812 wrote to memory of 904	2812	cmd.exe	sc.exe
PID 2812 wrote to memory of 552	2812	cmd.exe	WMIC.exe
PID 2812 wrote to memory of 552	2812	cmd.exe	WMIC.exe
PID 2812 wrote to memory of 552	2812	cmd.exe	WMIC.exe
PID 2812 wrote to memory of 1840	2812	cmd.exe	sc.exe

C:\Windows\system32\cmd.exe
cmd /c "C:\Users\Admin\AppData\Local\Temp\Optimizer\Pack Optimization\1. Otimizar Windows\+FPS\Desabilitar Serviços.cmd"
1⤵
- Suspicious use of WriteProcessMemory
PID:2812

C:\Windows\System32\Wbem\WMIC.exe
wmic service where name='SysMain' call ChangeStartmode Disabled
2⤵
- Suspicious use of AdjustPrivilegeToken
PID:2052

C:\Windows\system32\sc.exe
sc stop "SysMain"
2⤵
- Launches sc.exe
PID:3064

C:\Windows\System32\Wbem\WMIC.exe
wmic service where name='wisvc' call ChangeStartmode Disabled
2⤵
- Suspicious use of AdjustPrivilegeToken
PID:2524

C:\Windows\system32\sc.exe
sc stop "wisvc"
2⤵
- Launches sc.exe
PID:2700

C:\Windows\System32\Wbem\WMIC.exe
wmic service where name='icssvc' call ChangeStartmode Disabled
2⤵
PID:2460

C:\Windows\system32\sc.exe
sc stop "icssvc"
2⤵
- Launches sc.exe
PID:2340

C:\Windows\System32\Wbem\WMIC.exe
wmic service where name='Fax' call ChangeStartmode Disabled
2⤵
PID:2516

C:\Windows\system32\sc.exe
sc stop "Fax"
2⤵
- Launches sc.exe
PID:2548

C:\Windows\System32\Wbem\WMIC.exe
wmic service where name='SessionEnv' call ChangeStartmode Disabled
2⤵
PID:2556

C:\Windows\system32\sc.exe
sc stop "SessionEnv"
2⤵
- Launches sc.exe
PID:2380

C:\Windows\System32\Wbem\WMIC.exe
wmic service where name='TermService' call ChangeStartmode Disabled
2⤵
PID:2392

C:\Windows\system32\sc.exe
sc stop "TermService"
2⤵
- Launches sc.exe
PID:2364

C:\Windows\System32\Wbem\WMIC.exe
wmic service where name='bthserv' call ChangeStartmode Disabled
2⤵
PID:2408

C:\Windows\system32\sc.exe
sc stop "bthserv"
2⤵
- Launches sc.exe
PID:2188

C:\Windows\System32\Wbem\WMIC.exe
wmic service where name='TabletInputService' call ChangeStartmode Disabled
2⤵
PID:1856

C:\Windows\system32\sc.exe
sc stop "TabletInputService"
2⤵
- Launches sc.exe
PID:324

C:\Windows\System32\Wbem\WMIC.exe
wmic service where name='DiagTrack' call ChangeStartmode Disabled
2⤵
PID:2316

C:\Windows\system32\sc.exe
sc stop "DiagTrack"
2⤵
- Launches sc.exe
PID:576

C:\Windows\System32\Wbem\WMIC.exe
wmic service where name='DPS' call ChangeStartmode Disabled
2⤵
PID:812

C:\Windows\system32\sc.exe
sc stop "DPS"
2⤵
- Launches sc.exe
PID:904

C:\Windows\System32\Wbem\WMIC.exe
wmic service where name='DoSvc' call ChangeStartmode Disabled
2⤵
PID:552

C:\Windows\system32\sc.exe
sc stop "DoSvc"
2⤵
- Launches sc.exe
PID:1840

C:\Windows\System32\Wbem\WMIC.exe
wmic service where name='WpnService' call ChangeStartmode Disabled
2⤵
PID:1488

C:\Windows\system32\sc.exe
sc stop "WpnService"
2⤵
- Launches sc.exe
PID:536

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Create or Modify System Process

T1543

Windows Service

T1543.003

Privilege Escalation

Create or Modify System Process

T1543

Windows Service

T1543.003

Defense Evasion

Impair Defenses

T1562

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Service Stop

T1489

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads