c588680b751d0c61e0cb068db13b7866d220bbf342e81ea9802939e167f5db29 | Triage

Resubmissions

08/06/2024, 17:43

240608-wa3sgseg52 3

08/06/2024, 17:38

240608-v7qzhseg38 7

Analysis

max time kernel
61s
max time network
64s
platform
windows7_x64
resource
win7-20240508-en
resource tags

arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system
submitted
08/06/2024, 17:43

Sharing

Reason

Machine shutdown

Report Analysis Logs

General

Target

Catto Boi The Quest for the Frozen Tuna (04)/data/exe/shut.bat
Size

28B
MD5

15fdc55e9e8b1f0ac3f74108692baa36
SHA1

c5c6bcd7b0c2db0f5c5368c5f4dde13f7ced2e7c
SHA256

1c781f302420d20f326372c5c1c8adaa77a5e2c64fa83d0d59e10b4e25ad3b72
SHA512

f872613bd06bb710c4f9451996cfd49451bb7e359604c247085d0cfff6d0518181d367629762db458b236b1d12ed85f3367c914da512886e028f0502aa28e0c2

Score

1^/10

Malware Config

Signatures

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeShutdownPrivilege	3012	shutdown.exe
Token: SeRemoteShutdownPrivilege	3012	shutdown.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2344 wrote to memory of 3012	2344	cmd.exe	29
PID 2344 wrote to memory of 3012	2344	cmd.exe	29
PID 2344 wrote to memory of 3012	2344	cmd.exe	29

C:\Windows\system32\cmd.exe
cmd /c "C:\Users\Admin\AppData\Local\Temp\Catto Boi The Quest for the Frozen Tuna (04)\data\exe\shut.bat"
1⤵
- Suspicious use of WriteProcessMemory
PID:2344
- C:\Windows\system32\shutdown.exe
  shutdown /s /t 60
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  PID:3012

C:\Windows\system32\LogonUI.exe
"LogonUI.exe" /flags:0x0
1⤵
PID:2952

C:\Windows\system32\LogonUI.exe
"LogonUI.exe" /flags:0x1
1⤵
PID:1536

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1536-1-0x0000000002AB0000-0x0000000002AB1000-memory.dmp

Filesize
4KB

Download
memory/2952-0-0x0000000002E90000-0x0000000002E91000-memory.dmp

Filesize
4KB

Download