Analysis
-
max time kernel
147s -
max time network
150s -
platform
windows11-21h2_x64 -
resource
win11-20240419-en -
resource tags
arch:x64arch:x86image:win11-20240419-enlocale:en-usos:windows11-21h2-x64system -
submitted
29-04-2024 13:04
Static task
static1
Behavioral task
behavioral1
Sample
bsod.bat
Resource
win7-20240221-en
windows7-x64
7 signatures
150 seconds
Behavioral task
behavioral2
Sample
bsod.bat
Resource
win10-20240404-en
windows10-1703-x64
12 signatures
150 seconds
Behavioral task
behavioral3
Sample
bsod.bat
Resource
win10v2004-20240226-en
windows10-2004-x64
13 signatures
150 seconds
General
-
Target
bsod.bat
-
Size
245B
-
MD5
cbe26c3ef6afc754899d5aee9c9a6ff2
-
SHA1
d18459dfd94c000b4c13353545d7e49d05f72dd3
-
SHA256
c88915ae213caec84c0c4d84d52cb84e1f68c6eee6e760ad52602bab890cac12
-
SHA512
7d5623e324a6cd0fe2237018b4b72539af889eb6de101ea0d6c3928904fc9761bb98057e54f35763549e37d7c46cdaceb3c8af4d2434af4033a5b03e7c26e94e
Malware Config
Signatures
-
Drops startup file 1 IoCs
description ioc Process File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\desktop.ini attrib.exe -
Modifies file permissions 1 TTPs 1 IoCs
pid Process 3612 takeown.exe -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Drops desktop.ini file(s) 64 IoCs
description ioc Process File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\SendTo\desktop.ini attrib.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\System Tools\desktop.ini attrib.exe File opened for modification C:\Users\Admin\Favorites\desktop.ini attrib.exe File opened for modification C:\Users\Default\AppData\Local\Microsoft\Windows\WinX\Group2\desktop.ini attrib.exe File opened for modification C:\Users\Default\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\desktop.ini attrib.exe File opened for modification C:\Users\Admin\AppData\Local\Microsoft\Windows\WinX\Group1\desktop.ini attrib.exe File opened for modification C:\Users\Admin\Contacts\desktop.ini attrib.exe File opened for modification C:\Users\Admin\Pictures\Camera Roll\desktop.ini attrib.exe File opened for modification C:\Users\All Users\Microsoft\Windows\Start Menu\Programs\Accessories\desktop.ini attrib.exe File opened for modification C:\Users\Default\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessories\Desktop.ini attrib.exe File opened for modification C:\Users\Public\AccountPictures\desktop.ini attrib.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\desktop.ini attrib.exe File opened for modification C:\Users\Default\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\desktop.ini attrib.exe File opened for modification C:\Users\Public\Libraries\desktop.ini attrib.exe File opened for modification C:\Users\Public\Pictures\desktop.ini attrib.exe File opened for modification C:\Users\Public\desktop.ini attrib.exe File opened for modification C:\Users\Admin\Downloads\desktop.ini attrib.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\desktop.ini attrib.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\desktop.ini attrib.exe File opened for modification C:\Users\Admin\Links\desktop.ini attrib.exe File opened for modification C:\Users\Admin\Searches\desktop.ini attrib.exe File opened for modification C:\Users\Public\Downloads\desktop.ini attrib.exe File opened for modification C:\Users\Admin\AppData\Local\Microsoft\Windows\Application Shortcuts\desktop.ini attrib.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\AccountPictures\desktop.ini attrib.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Maintenance\Desktop.ini attrib.exe File opened for modification C:\Users\Admin\Pictures\desktop.ini attrib.exe File opened for modification C:\Users\All Users\Microsoft\Windows\Start Menu\Programs\System Tools\desktop.ini attrib.exe File opened for modification C:\Users\All Users\Microsoft\Windows\Start Menu\desktop.ini attrib.exe File opened for modification C:\Users\Public\Documents\desktop.ini attrib.exe File opened for modification C:\Users\Admin\Favorites\Links\desktop.ini attrib.exe File opened for modification C:\Users\All Users\Microsoft\Windows\Start Menu\Programs\desktop.ini attrib.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Libraries\desktop.ini attrib.exe File opened for modification C:\Users\Admin\AppData\Local\Microsoft\Windows\WinX\Group3\desktop.ini attrib.exe File opened for modification C:\Users\Admin\Desktop\desktop.ini attrib.exe File opened for modification C:\Users\All Users\Microsoft\Windows\Start Menu\Programs\Startup\desktop.ini attrib.exe File opened for modification C:\Users\Public\Music\desktop.ini attrib.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\User Pinned\TaskBar\desktop.ini attrib.exe File opened for modification C:\Users\All Users\Microsoft\Windows\Start Menu\Programs\Maintenance\Desktop.ini attrib.exe File opened for modification C:\Users\All Users\Microsoft\Windows\Start Menu\Programs\Windows PowerShell\desktop.ini attrib.exe File opened for modification C:\Users\Public\Videos\desktop.ini attrib.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessories\Desktop.ini attrib.exe File opened for modification C:\Users\Default\AppData\Local\Microsoft\Windows\WinX\Group1\desktop.ini attrib.exe File opened for modification C:\Users\Default\AppData\Local\Microsoft\Windows\WinX\Group3\desktop.ini attrib.exe File opened for modification C:\Users\Admin\AppData\Local\Microsoft\Windows\Burn\Burn1\desktop.ini attrib.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessibility\desktop.ini attrib.exe File opened for modification C:\Users\Admin\OneDrive\desktop.ini attrib.exe File opened for modification C:\Users\All Users\Microsoft\Windows\Start Menu\Programs\Accessibility\Desktop.ini attrib.exe File opened for modification C:\Users\All Users\Microsoft\Windows\Start Menu\Programs\Administrative Tools\desktop.ini attrib.exe File opened for modification C:\Users\Default\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Maintenance\Desktop.ini attrib.exe File opened for modification C:\Users\Admin\AppData\Local\Microsoft\Windows\Burn\Burn\desktop.ini attrib.exe File opened for modification C:\Users\Admin\AppData\Local\Microsoft\Windows\History\desktop.ini attrib.exe File opened for modification C:\Users\Admin\AppData\Local\Microsoft\Windows\WinX\Group2\desktop.ini attrib.exe File opened for modification C:\Users\Admin\Documents\desktop.ini attrib.exe File opened for modification C:\Users\Admin\Videos\desktop.ini attrib.exe File opened for modification C:\Users\All Users\Microsoft\Windows\Start Menu\Programs\Accessories\System Tools\desktop.ini attrib.exe File opened for modification C:\Users\Admin\Music\desktop.ini attrib.exe File opened for modification C:\Users\Admin\Pictures\Saved Pictures\desktop.ini attrib.exe File opened for modification C:\Users\Default\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessibility\desktop.ini attrib.exe File opened for modification C:\Users\Public\Desktop\desktop.ini attrib.exe File opened for modification C:\Users\Admin\AppData\Local\Microsoft\Windows\Burn\Burn2\desktop.ini attrib.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\desktop.ini attrib.exe File opened for modification C:\Users\Default\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\System Tools\desktop.ini attrib.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Administrative Tools\desktop.ini attrib.exe File opened for modification C:\Users\Admin\Saved Games\desktop.ini attrib.exe -
Suspicious use of WriteProcessMemory 6 IoCs
description pid Process procid_target PID 1596 wrote to memory of 3612 1596 cmd.exe 80 PID 1596 wrote to memory of 3612 1596 cmd.exe 80 PID 1596 wrote to memory of 4908 1596 cmd.exe 81 PID 1596 wrote to memory of 4908 1596 cmd.exe 81 PID 1596 wrote to memory of 4664 1596 cmd.exe 84 PID 1596 wrote to memory of 4664 1596 cmd.exe 84 -
Views/modifies file attributes 1 TTPs 2 IoCs
pid Process 4908 attrib.exe 4664 attrib.exe
Processes
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\bsod.bat"1⤵
- Suspicious use of WriteProcessMemory
PID:1596 -
C:\Windows\system32\takeown.exetakeown /f C:\users\2⤵
- Modifies file permissions
PID:3612
-
-
C:\Windows\system32\attrib.exeattrib -h -r -s /s /d2⤵
- Drops startup file
- Drops desktop.ini file(s)
- Views/modifies file attributes
PID:4908
-
-
C:\Windows\system32\attrib.exeattrib +h +r +s /s /d2⤵
- Views/modifies file attributes
PID:4664
-