Analysis
-
max time kernel
119s -
max time network
123s -
platform
windows7_x64 -
resource
win7-20240221-en -
resource tags
arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system -
submitted
29/04/2024, 13:04
Static task
static1
Behavioral task
behavioral1
Sample
bsod.bat
Resource
win7-20240221-en
windows7-x64
7 signatures
150 seconds
Behavioral task
behavioral2
Sample
bsod.bat
Resource
win10-20240404-en
windows10-1703-x64
12 signatures
150 seconds
Behavioral task
behavioral3
Sample
bsod.bat
Resource
win10v2004-20240226-en
windows10-2004-x64
13 signatures
150 seconds
General
-
Target
bsod.bat
-
Size
245B
-
MD5
cbe26c3ef6afc754899d5aee9c9a6ff2
-
SHA1
d18459dfd94c000b4c13353545d7e49d05f72dd3
-
SHA256
c88915ae213caec84c0c4d84d52cb84e1f68c6eee6e760ad52602bab890cac12
-
SHA512
7d5623e324a6cd0fe2237018b4b72539af889eb6de101ea0d6c3928904fc9761bb98057e54f35763549e37d7c46cdaceb3c8af4d2434af4033a5b03e7c26e94e
Malware Config
Signatures
-
Deletes itself 1 IoCs
pid Process 2872 cmd.exe -
Drops startup file 1 IoCs
description ioc Process File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\desktop.ini attrib.exe -
Modifies file permissions 1 TTPs 1 IoCs
pid Process 3032 takeown.exe -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Drops desktop.ini file(s) 64 IoCs
description ioc Process File opened for modification C:\Users\All Users\Microsoft\Windows\Start Menu\Programs\Accessories\Tablet PC\Desktop.ini attrib.exe File opened for modification C:\Users\All Users\Microsoft\Windows\Start Menu\Programs\Maintenance\Desktop.ini attrib.exe File opened for modification C:\Users\Default\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\desktop.ini attrib.exe File opened for modification C:\Users\Public\desktop.ini attrib.exe File opened for modification C:\Users\All Users\Microsoft\Windows\Start Menu\Programs\desktop.ini attrib.exe File opened for modification C:\Users\Default\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Maintenance\Desktop.ini attrib.exe File opened for modification C:\Users\Public\Pictures\Sample Pictures\desktop.ini attrib.exe File opened for modification C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\BB0Z8TKM\desktop.ini attrib.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessories\Desktop.ini attrib.exe File opened for modification C:\Users\Admin\Favorites\Links for United States\desktop.ini attrib.exe File opened for modification C:\Users\Admin\Pictures\desktop.ini attrib.exe File opened for modification C:\Users\Admin\Favorites\Links\desktop.ini attrib.exe File opened for modification C:\Users\All Users\Microsoft\Windows\Start Menu\Programs\Startup\desktop.ini attrib.exe File opened for modification C:\Users\Default\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessories\Desktop.ini attrib.exe File opened for modification C:\Users\Public\Libraries\desktop.ini attrib.exe File opened for modification C:\Users\Admin\AppData\Local\Microsoft\Feeds Cache\AS4I30IR\desktop.ini attrib.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\User Pinned\TaskBar\desktop.ini attrib.exe File opened for modification C:\Users\Admin\Searches\desktop.ini attrib.exe File opened for modification C:\Users\Default\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessories\System Tools\Desktop.ini attrib.exe File opened for modification C:\Users\Admin\Links\desktop.ini attrib.exe File opened for modification C:\Users\Admin\Videos\desktop.ini attrib.exe File opened for modification C:\Users\All Users\Microsoft\Windows\Start Menu\desktop.ini attrib.exe File opened for modification C:\Users\Admin\AppData\Local\Microsoft\Windows Mail\Stationery\Desktop.ini attrib.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Maintenance\Desktop.ini attrib.exe File opened for modification C:\Users\Admin\Contacts\desktop.ini attrib.exe File opened for modification C:\Users\Admin\Documents\desktop.ini attrib.exe File opened for modification C:\Users\Public\Music\desktop.ini attrib.exe File opened for modification C:\Users\Admin\AppData\Local\Microsoft\Feeds Cache\desktop.ini attrib.exe File opened for modification C:\Users\Admin\AppData\Local\Microsoft\Windows\History\desktop.ini attrib.exe File opened for modification C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\1OEGTYQG\desktop.ini attrib.exe File opened for modification C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\LS99WIMF\desktop.ini attrib.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\SendTo\Desktop.ini attrib.exe File opened for modification C:\Users\Public\Documents\desktop.ini attrib.exe File opened for modification C:\Users\All Users\Microsoft\Windows\Ringtones\desktop.ini attrib.exe File opened for modification C:\Users\All Users\Microsoft\Windows\Start Menu\Programs\Accessories\Windows PowerShell\desktop.ini attrib.exe File opened for modification C:\Users\All Users\Microsoft\Windows\Start Menu\Programs\Accessories\Desktop.ini attrib.exe File opened for modification C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\desktop.ini attrib.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Administrative Tools\desktop.ini attrib.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\desktop.ini attrib.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\desktop.ini attrib.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\desktop.ini attrib.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessories\Accessibility\Desktop.ini attrib.exe File opened for modification C:\Users\Public\Pictures\desktop.ini attrib.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Libraries\desktop.ini attrib.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessories\System Tools\Desktop.ini attrib.exe File opened for modification C:\Users\All Users\Microsoft\Windows\Start Menu\Programs\Accessories\System Tools\Desktop.ini attrib.exe File opened for modification C:\Users\All Users\Microsoft\Windows\Start Menu\Programs\Administrative Tools\desktop.ini attrib.exe File opened for modification C:\Users\Public\Videos\Sample Videos\desktop.ini attrib.exe File opened for modification C:\Users\Admin\AppData\Local\Microsoft\Feeds Cache\266EQP1S\desktop.ini attrib.exe File opened for modification C:\Users\Admin\AppData\Local\Microsoft\Windows\History\History.IE5\desktop.ini attrib.exe File opened for modification C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\desktop.ini attrib.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\desktop.ini attrib.exe File opened for modification C:\Users\Admin\AppData\Local\Microsoft\Windows\Burn\Burn\desktop.ini attrib.exe File opened for modification C:\Users\Admin\Downloads\desktop.ini attrib.exe File opened for modification C:\Users\Default\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessories\Accessibility\Desktop.ini attrib.exe File opened for modification C:\Users\Public\Music\Sample Music\desktop.ini attrib.exe File opened for modification C:\Users\Admin\Music\desktop.ini attrib.exe File opened for modification C:\Users\Public\Recorded TV\Sample Media\desktop.ini attrib.exe File opened for modification C:\Users\Public\Recorded TV\desktop.ini attrib.exe File opened for modification C:\Users\Public\Downloads\desktop.ini attrib.exe File opened for modification C:\Users\Public\Videos\desktop.ini attrib.exe File opened for modification C:\Users\Admin\AppData\Local\Microsoft\Feeds Cache\2Y0HPGOE\desktop.ini attrib.exe File opened for modification C:\Users\Admin\AppData\Local\Microsoft\Feeds Cache\JP38OXIN\desktop.ini attrib.exe File opened for modification C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\WZPJ6IGS\desktop.ini attrib.exe -
Suspicious use of WriteProcessMemory 9 IoCs
description pid Process procid_target PID 2872 wrote to memory of 3032 2872 cmd.exe 29 PID 2872 wrote to memory of 3032 2872 cmd.exe 29 PID 2872 wrote to memory of 3032 2872 cmd.exe 29 PID 2872 wrote to memory of 3016 2872 cmd.exe 30 PID 2872 wrote to memory of 3016 2872 cmd.exe 30 PID 2872 wrote to memory of 3016 2872 cmd.exe 30 PID 2872 wrote to memory of 2728 2872 cmd.exe 32 PID 2872 wrote to memory of 2728 2872 cmd.exe 32 PID 2872 wrote to memory of 2728 2872 cmd.exe 32 -
Views/modifies file attributes 1 TTPs 2 IoCs
pid Process 2728 attrib.exe 3016 attrib.exe
Processes
-
C:\Windows\system32\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\bsod.bat"1⤵
- Deletes itself
- Suspicious use of WriteProcessMemory
PID:2872 -
C:\Windows\system32\takeown.exetakeown /f C:\users\2⤵
- Modifies file permissions
PID:3032
-
-
C:\Windows\system32\attrib.exeattrib -h -r -s /s /d2⤵
- Drops startup file
- Drops desktop.ini file(s)
- Views/modifies file attributes
PID:3016
-
-
C:\Windows\system32\attrib.exeattrib +h +r +s /s /d2⤵
- Views/modifies file attributes
PID:2728
-