ddda99a2c8524ed4d7842c3c4ec725e7f6f0a27f808a637dfdebc0b86410e460 | Triage

Resubmissions

02/06/2024, 21:40

240602-1jdbeafh6s 1

Analysis

max time kernel
0s
max time network
11s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
02/06/2024, 21:40

Sharing

Reason

Machine shutdown

Report Analysis Logs

General

Target

hi.bat
Size

33B
MD5

5b9dafb518c81a631808916743a8cc45
SHA1

35500c740cda0e9b389baa7e6e655c64b9ce3469
SHA256

ddda99a2c8524ed4d7842c3c4ec725e7f6f0a27f808a637dfdebc0b86410e460
SHA512

c2a3c3520922ccd6e59c2fc05bbb36944a9deeb97eef56aab98ffed6196fe77f1af464325b4aa704b1bce1771148077b21f9af70909eca685473155db7b03394

Score

1^/10

Malware Config

Signatures

Kills process with taskkill 1 IoCs

pid	Process
1704	taskkill.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	1704	taskkill.exe

Suspicious use of WriteProcessMemory 2 IoCs

description	pid	Process	procid_target
PID 3164 wrote to memory of 1704	3164	cmd.exe	84
PID 3164 wrote to memory of 1704	3164	cmd.exe	84

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\hi.bat"
1⤵
- Suspicious use of WriteProcessMemory
PID:3164
- C:\Windows\system32\taskkill.exe
  taskkill /f /im svchost.exe
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:1704

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads