9a7bd4caeb6c20f3c7d7bf3c255707c458c42e42efb0a3d8daf5989474509563 | Triage

Analysis

max time kernel
58s
max time network
59s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
04/05/2024, 12:56

Sharing

Reason

Machine shutdown

Report Analysis Logs

General

Target

Iloveyoutest.bat
Size

328B
MD5

a8829f1a59ddc6a18a6e0c69e9b1ca9b
SHA1

e622f83d445ed6a3af72f9ed43ec2f1c6bcc3898
SHA256

9a7bd4caeb6c20f3c7d7bf3c255707c458c42e42efb0a3d8daf5989474509563
SHA512

36f87dbcd09a29f5a8e65494fcabf1111cd4001c641076c666633e1bc320ec19364fedfe08af8e2369c6e5926183323a85435743e03d166237220b9283ace66d

Score

1^/10

Malware Config

Signatures

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeShutdownPrivilege	2372	shutdown.exe
Token: SeRemoteShutdownPrivilege	2372	shutdown.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 1720 wrote to memory of 2372	1720	cmd.exe	29
PID 1720 wrote to memory of 2372	1720	cmd.exe	29
PID 1720 wrote to memory of 2372	1720	cmd.exe	29

C:\Windows\system32\cmd.exe
cmd /c "C:\Users\Admin\AppData\Local\Temp\Iloveyoutest.bat"
1⤵
- Suspicious use of WriteProcessMemory
PID:1720
- C:\Windows\system32\shutdown.exe
  shutdown -s -t 50
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  PID:2372

C:\Windows\system32\LogonUI.exe
"LogonUI.exe" /flags:0x0
1⤵
PID:2980

C:\Windows\system32\LogonUI.exe
"LogonUI.exe" /flags:0x1
1⤵
PID:2632

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2632-1-0x0000000002B30000-0x0000000002B31000-memory.dmp

Filesize
4KB

Download
memory/2980-0-0x0000000002D90000-0x0000000002D91000-memory.dmp

Filesize
4KB

Download