988f5cc56caf26115f78a50166cac0dd7724d11a2501f04bafc263d57b86e34f

Analysis

max time kernel
149s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
21-05-2024 16:20

Target

spiderman.bat
Size

254B
MD5

2969a9253db05b47faa53ad2e95ed622
SHA1

172357e51f81b513769b39d1c92a25a4e2aa415d
SHA256

4c31e0eadcc1f277cea1124f4e6337665f2d195c781c556453db8a003a6fec7b
SHA512

1087ffe43314ce73c930538436a6de89339c21fc455d1e9e540ba06f9452d7d41bf843f181a28e6a2e2717a729222ee11325a3c8f6a4e22099c7abee20e94daa

Score

8^/10

Creates new service(s) 2 TTPs
persistence execution

Windows Service
T1543.003

Service Execution
T1569.002
Stops running service(s) 4 TTPs
evasion execution

Windows Service
T1543.003

Impair Defenses
T1562

Service Stop
T1489

Service Execution
T1569.002
Launches sc.exe 7 IoCs
Sc.exe is a Windows utlilty to control services on the system.

Processes:

sc.exesc.exesc.exesc.exesc.exesc.exesc.exe

pid process

1540 sc.exe
3308 sc.exe
1164 sc.exe
1080 sc.exe
3720 sc.exe
3848 sc.exe
1284 sc.exe
Kills process with taskkill 1 IoCs
evasion

Processes:

taskkill.exe

pid process

4796 taskkill.exe
Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

taskkill.exe

description pid process

Token: SeDebugPrivilege 4796 taskkill.exe

pid	process
4796	taskkill.exe

description	pid	process
Token: SeDebugPrivilege	4796	taskkill.exe

Suspicious use of WriteProcessMemory 16 IoCs

Processes:

cmd.exe

description	pid	process	target process
PID 2396 wrote to memory of 1540	2396	cmd.exe	sc.exe
PID 2396 wrote to memory of 1540	2396	cmd.exe	sc.exe
PID 2396 wrote to memory of 3308	2396	cmd.exe	sc.exe
PID 2396 wrote to memory of 3308	2396	cmd.exe	sc.exe
PID 2396 wrote to memory of 1164	2396	cmd.exe	sc.exe
PID 2396 wrote to memory of 1164	2396	cmd.exe	sc.exe
PID 2396 wrote to memory of 1080	2396	cmd.exe	sc.exe
PID 2396 wrote to memory of 1080	2396	cmd.exe	sc.exe
PID 2396 wrote to memory of 4796	2396	cmd.exe	taskkill.exe
PID 2396 wrote to memory of 4796	2396	cmd.exe	taskkill.exe
PID 2396 wrote to memory of 3720	2396	cmd.exe	sc.exe
PID 2396 wrote to memory of 3720	2396	cmd.exe	sc.exe
PID 2396 wrote to memory of 3848	2396	cmd.exe	sc.exe
PID 2396 wrote to memory of 3848	2396	cmd.exe	sc.exe
PID 2396 wrote to memory of 1284	2396	cmd.exe	sc.exe
PID 2396 wrote to memory of 1284	2396	cmd.exe	sc.exe

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\spiderman.bat"
1⤵
- Suspicious use of WriteProcessMemory
PID:2396

C:\Windows\system32\sc.exe
sc create stsrv binPath="C:\Users\Admin\AppData\Local\Temp\TigerHwidTool.exe" start=auto DisplayName="stsrv"
2⤵
- Launches sc.exe
PID:1284