49e0b3dd4c0b710ad0574352db2b2c46610bec86a02d9abc3f981d583f3acadf

Resubmissions

02-06-2024 09:49

02-06-2024 09:48

max time kernel
91s
max time network
125s
platform
windows11-21h2_x64
resource
win11-20240426-en
resource tags

arch:x64arch:x86image:win11-20240426-enlocale:en-usos:windows11-21h2-x64system
submitted
02-06-2024 09:49

Target

processlasso_portable_64/stop-governor.bat
Size

147B
MD5

1a263ccbabef24fd1c38acd624b87364
SHA1

36adffa76fe886c52603b829db479474ac6daf90
SHA256

6955fbc82489a90e8bf1812db7baf52e2bb7b4eb170f50445570aeecef09beb7
SHA512

90fb3d4e006edd3f95d853a466fb41ca7cb1a12270b988102817c3fd8f870024bdd250bb7e5905e0e371c877f2fd45894c104cf39ecc327e07c2ff56bac3744f

Score

1^/10

Suspicious use of AdjustPrivilegeToken 9 IoCs

description	pid	Process
Token: SeAssignPrimaryTokenPrivilege	5036	ProcessGovernor.exe
Token: SeDebugPrivilege	5036	ProcessGovernor.exe
Token: SeChangeNotifyPrivilege	5036	ProcessGovernor.exe
Token: SeIncBasePriorityPrivilege	5036	ProcessGovernor.exe
Token: SeIncreaseQuotaPrivilege	5036	ProcessGovernor.exe
Token: SeProfSingleProcessPrivilege	5036	ProcessGovernor.exe
Token: SeCreateGlobalPrivilege	5036	ProcessGovernor.exe
Token: SeBackupPrivilege	5036	ProcessGovernor.exe
Token: SeRestorePrivilege	5036	ProcessGovernor.exe

Suspicious use of WriteProcessMemory 6 IoCs

description	pid	Process	procid_target
PID 1456 wrote to memory of 4752	1456	cmd.exe	77
PID 1456 wrote to memory of 4752	1456	cmd.exe	77
PID 4752 wrote to memory of 3620	4752	net.exe	78
PID 4752 wrote to memory of 3620	4752	net.exe	78
PID 1456 wrote to memory of 5036	1456	cmd.exe	79
PID 1456 wrote to memory of 5036	1456	cmd.exe	79

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\processlasso_portable_64\stop-governor.bat"
1⤵
- Suspicious use of WriteProcessMemory
PID:1456
- C:\Windows\system32\net.exe
  net stop ProcessGovernor
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:4752
- - C:\Windows\system32\net1.exe
    C:\Windows\system32\net1 stop ProcessGovernor
    3⤵
    PID:3620
- C:\Users\Admin\AppData\Local\Temp\processlasso_portable_64\ProcessGovernor.exe
  ProcessGovernor.exe /manual /exit
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  PID:5036