f6199fe0c5630f73c0cd588e71626ab8552fb312e90e441bbe6f1ebd50bc7ccb

Analysis

max time kernel
66s
max time network
53s
platform
windows10-2004_x64
resource
win10v2004-20240419-en
resource tags

arch:x64arch:x86image:win10v2004-20240419-enlocale:en-usos:windows10-2004-x64system
submitted
28-04-2024 18:40

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

Cleaner7.bat
Size

253KB
MD5

c26c52657c60cd9590dc11c8d6f563a5
SHA1

7517d767b64d983fa28545dbedb76c937049e775
SHA256

54ed81f8e76aba8298bd302f872b4e1bbabaee272575c39e0f18ddc23ad6c2f3
SHA512

8844ec48ee632c59d4cd7421856e4cd160bdea86e4100fac72ae321cd6cb934352f85aaa3b727fd17a9e96c10592c013d44fe12d5850edfbc479df23b92cf00a
SSDEEP

1536:VNoZxBOz2oCfgCWfr3bwUWgn8q01L5LvLpLjL5sff4oH9sffzs:UfgCW4UWgnh4oH9qzs

Score

8^/10

evasion

Malware Config

Signatures

Stops running service(s) 3 TTPs
evasion

Windows Service
T1543.003

Impair Defenses
T1562

Service Stop
T1489
Launches sc.exe 4 IoCs
Sc.exe is a Windows utlilty to control services on the system.

Processes:

sc.exesc.exesc.exesc.exe

pid process

4540 sc.exe
4396 sc.exe
60 sc.exe
432 sc.exe

pid	process
4540	sc.exe
4396	sc.exe
60	sc.exe
432	sc.exe

Kills process with taskkill 15 IoCs

evasion

Processes:

taskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exe

pid	process
4236	taskkill.exe
2108	taskkill.exe
1436	taskkill.exe
3820	taskkill.exe
5068	taskkill.exe
2044	taskkill.exe
2492	taskkill.exe
1864	taskkill.exe
4860	taskkill.exe
3368	taskkill.exe
2852	taskkill.exe
552	taskkill.exe
4244	taskkill.exe
3012	taskkill.exe
4768	taskkill.exe

Suspicious use of AdjustPrivilegeToken 15 IoCs

Processes:

taskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exe

description	pid	process
Token: SeDebugPrivilege	2108	taskkill.exe
Token: SeDebugPrivilege	4860	taskkill.exe
Token: SeDebugPrivilege	1436	taskkill.exe
Token: SeDebugPrivilege	552	taskkill.exe
Token: SeDebugPrivilege	3368	taskkill.exe
Token: SeDebugPrivilege	3820	taskkill.exe
Token: SeDebugPrivilege	4244	taskkill.exe
Token: SeDebugPrivilege	5068	taskkill.exe
Token: SeDebugPrivilege	1864	taskkill.exe
Token: SeDebugPrivilege	2044	taskkill.exe
Token: SeDebugPrivilege	3012	taskkill.exe
Token: SeDebugPrivilege	2492	taskkill.exe
Token: SeDebugPrivilege	4768	taskkill.exe
Token: SeDebugPrivilege	4236	taskkill.exe
Token: SeDebugPrivilege	2852	taskkill.exe

Suspicious use of WriteProcessMemory 40 IoCs

Processes:

cmd.exe

description	pid	process	target process
PID 2652 wrote to memory of 3864	2652	cmd.exe	cacls.exe
PID 2652 wrote to memory of 3864	2652	cmd.exe	cacls.exe
PID 2652 wrote to memory of 2108	2652	cmd.exe	taskkill.exe
PID 2652 wrote to memory of 2108	2652	cmd.exe	taskkill.exe
PID 2652 wrote to memory of 4860	2652	cmd.exe	taskkill.exe
PID 2652 wrote to memory of 4860	2652	cmd.exe	taskkill.exe
PID 2652 wrote to memory of 1436	2652	cmd.exe	taskkill.exe
PID 2652 wrote to memory of 1436	2652	cmd.exe	taskkill.exe
PID 2652 wrote to memory of 552	2652	cmd.exe	taskkill.exe
PID 2652 wrote to memory of 552	2652	cmd.exe	taskkill.exe
PID 2652 wrote to memory of 3368	2652	cmd.exe	taskkill.exe
PID 2652 wrote to memory of 3368	2652	cmd.exe	taskkill.exe
PID 2652 wrote to memory of 3820	2652	cmd.exe	taskkill.exe
PID 2652 wrote to memory of 3820	2652	cmd.exe	taskkill.exe
PID 2652 wrote to memory of 4244	2652	cmd.exe	taskkill.exe
PID 2652 wrote to memory of 4244	2652	cmd.exe	taskkill.exe
PID 2652 wrote to memory of 5068	2652	cmd.exe	taskkill.exe
PID 2652 wrote to memory of 5068	2652	cmd.exe	taskkill.exe
PID 2652 wrote to memory of 1864	2652	cmd.exe	taskkill.exe
PID 2652 wrote to memory of 1864	2652	cmd.exe	taskkill.exe
PID 2652 wrote to memory of 2044	2652	cmd.exe	taskkill.exe
PID 2652 wrote to memory of 2044	2652	cmd.exe	taskkill.exe
PID 2652 wrote to memory of 3012	2652	cmd.exe	taskkill.exe
PID 2652 wrote to memory of 3012	2652	cmd.exe	taskkill.exe
PID 2652 wrote to memory of 2492	2652	cmd.exe	taskkill.exe
PID 2652 wrote to memory of 2492	2652	cmd.exe	taskkill.exe
PID 2652 wrote to memory of 4768	2652	cmd.exe	taskkill.exe
PID 2652 wrote to memory of 4768	2652	cmd.exe	taskkill.exe
PID 2652 wrote to memory of 4236	2652	cmd.exe	taskkill.exe
PID 2652 wrote to memory of 4236	2652	cmd.exe	taskkill.exe
PID 2652 wrote to memory of 2852	2652	cmd.exe	taskkill.exe
PID 2652 wrote to memory of 2852	2652	cmd.exe	taskkill.exe
PID 2652 wrote to memory of 60	2652	cmd.exe	sc.exe
PID 2652 wrote to memory of 60	2652	cmd.exe	sc.exe
PID 2652 wrote to memory of 432	2652	cmd.exe	sc.exe
PID 2652 wrote to memory of 432	2652	cmd.exe	sc.exe
PID 2652 wrote to memory of 4540	2652	cmd.exe	sc.exe
PID 2652 wrote to memory of 4540	2652	cmd.exe	sc.exe
PID 2652 wrote to memory of 4396	2652	cmd.exe	sc.exe
PID 2652 wrote to memory of 4396	2652	cmd.exe	sc.exe

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\Cleaner7.bat"
1⤵
- Suspicious use of WriteProcessMemory
PID:2652

C:\Windows\system32\cacls.exe
"C:\Windows\system32\cacls.exe" "C:\Windows\system32\config\system"
2⤵
PID:3864

C:\Windows\system32\taskkill.exe
taskkill /f /im epicgameslauncher.exe
2⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:2108

C:\Windows\system32\taskkill.exe
taskkill /f /im FortniteClient-Win64-Shipping_EAC.exe
2⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:4860

C:\Windows\system32\taskkill.exe
taskkill /f /im FortniteClient-Win64-Shipping_BE.exe
2⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:1436

C:\Windows\system32\taskkill.exe
taskkill /f /im FortniteLauncher.exe
2⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:552

C:\Windows\system32\taskkill.exe
taskkill /f /im OneDrive.exe
2⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:3368

C:\Windows\system32\taskkill.exe
taskkill /f /im FortniteClient-Win64-Shipping.exe
2⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:3820

C:\Windows\system32\taskkill.exe
taskkill /f /im EpicGamesLauncher.exe
2⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:4244

C:\Windows\system32\taskkill.exe
taskkill /f /im UnrealCEFSubProcess.exe
2⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:5068

C:\Windows\system32\taskkill.exe
taskkill /f /im CEFProcess.exe
2⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:1864

C:\Windows\system32\taskkill.exe
taskkill /f /im EasyAntiCheat.exe
2⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:2044

C:\Windows\system32\taskkill.exe
taskkill /f /im BEService.exe
2⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:3012

C:\Windows\system32\taskkill.exe
taskkill /f /im BEServices.exe
2⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:2492

C:\Windows\system32\taskkill.exe
taskkill /f /im BattleEye.exe
2⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:4768

C:\Windows\system32\taskkill.exe
taskkill /f /im PerfWatson2.exe
2⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:4236

C:\Windows\system32\taskkill.exe
taskkill /f /im vgtray.exe
2⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:2852

C:\Windows\system32\sc.exe
Sc stop EasyAntiCheat
2⤵
- Launches sc.exe
PID:60

C:\Windows\system32\sc.exe
Sc stop FortniteClient-Win64-Shipping_EAC
2⤵
- Launches sc.exe
PID:432

C:\Windows\system32\sc.exe
Sc stop BattleEye
2⤵
- Launches sc.exe
PID:4540

C:\Windows\system32\sc.exe
Sc stop FortniteClient-Win64-Shipping_BE
2⤵
- Launches sc.exe
PID:4396

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Create or Modify System Process

T1543

Windows Service

T1543.003

Privilege Escalation

Create or Modify System Process

T1543

Windows Service

T1543.003

Defense Evasion

Impair Defenses

T1562

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Service Stop

T1489

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads