988f5cc56caf26115f78a50166cac0dd7724d11a2501f04bafc263d57b86e34f

Analysis

max time kernel
122s
max time network
126s
platform
windows7_x64
resource
win7-20240419-en
resource tags

arch:x64arch:x86image:win7-20240419-enlocale:en-usos:windows7-x64system
submitted
21-05-2024 16:20

Target

spiderman.bat
Size

254B
MD5

2969a9253db05b47faa53ad2e95ed622
SHA1

172357e51f81b513769b39d1c92a25a4e2aa415d
SHA256

4c31e0eadcc1f277cea1124f4e6337665f2d195c781c556453db8a003a6fec7b
SHA512

1087ffe43314ce73c930538436a6de89339c21fc455d1e9e540ba06f9452d7d41bf843f181a28e6a2e2717a729222ee11325a3c8f6a4e22099c7abee20e94daa

Score

8^/10

Creates new service(s) 2 TTPs
persistence execution

Windows Service
T1543.003

Service Execution
T1569.002
Stops running service(s) 4 TTPs
evasion execution

Windows Service
T1543.003

Impair Defenses
T1562

Service Stop
T1489

Service Execution
T1569.002
Deletes itself 1 IoCs

Processes:

cmd.exe

pid process

2288 cmd.exe
Launches sc.exe 7 IoCs
Sc.exe is a Windows utlilty to control services on the system.

Processes:

sc.exesc.exesc.exesc.exesc.exesc.exesc.exe

pid process

2736 sc.exe
2768 sc.exe
1708 sc.exe
2220 sc.exe
1256 sc.exe
2260 sc.exe
2724 sc.exe
Kills process with taskkill 1 IoCs
evasion

Processes:

taskkill.exe

pid process

2748 taskkill.exe
Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

taskkill.exe

description pid process

Token: SeDebugPrivilege 2748 taskkill.exe

pid	process
2288	cmd.exe

pid	process
2748	taskkill.exe

description	pid	process
Token: SeDebugPrivilege	2748	taskkill.exe

Suspicious use of WriteProcessMemory 24 IoCs

Processes:

cmd.exe

description	pid	process	target process
PID 2288 wrote to memory of 1708	2288	cmd.exe	sc.exe
PID 2288 wrote to memory of 1708	2288	cmd.exe	sc.exe
PID 2288 wrote to memory of 1708	2288	cmd.exe	sc.exe
PID 2288 wrote to memory of 2220	2288	cmd.exe	sc.exe
PID 2288 wrote to memory of 2220	2288	cmd.exe	sc.exe
PID 2288 wrote to memory of 2220	2288	cmd.exe	sc.exe
PID 2288 wrote to memory of 1256	2288	cmd.exe	sc.exe
PID 2288 wrote to memory of 1256	2288	cmd.exe	sc.exe
PID 2288 wrote to memory of 1256	2288	cmd.exe	sc.exe
PID 2288 wrote to memory of 2260	2288	cmd.exe	sc.exe
PID 2288 wrote to memory of 2260	2288	cmd.exe	sc.exe
PID 2288 wrote to memory of 2260	2288	cmd.exe	sc.exe
PID 2288 wrote to memory of 2748	2288	cmd.exe	taskkill.exe
PID 2288 wrote to memory of 2748	2288	cmd.exe	taskkill.exe
PID 2288 wrote to memory of 2748	2288	cmd.exe	taskkill.exe
PID 2288 wrote to memory of 2724	2288	cmd.exe	sc.exe
PID 2288 wrote to memory of 2724	2288	cmd.exe	sc.exe
PID 2288 wrote to memory of 2724	2288	cmd.exe	sc.exe
PID 2288 wrote to memory of 2736	2288	cmd.exe	sc.exe
PID 2288 wrote to memory of 2736	2288	cmd.exe	sc.exe
PID 2288 wrote to memory of 2736	2288	cmd.exe	sc.exe
PID 2288 wrote to memory of 2768	2288	cmd.exe	sc.exe
PID 2288 wrote to memory of 2768	2288	cmd.exe	sc.exe
PID 2288 wrote to memory of 2768	2288	cmd.exe	sc.exe

C:\Windows\system32\sc.exe
sc create stsrv binPath="C:\Users\Admin\AppData\Local\Temp\TigerHwidTool.exe" start=auto DisplayName="stsrv"
2⤵
- Launches sc.exe
PID:2768