Analysis
-
max time kernel
149s -
max time network
120s -
platform
windows7_x64 -
resource
win7-20240508-en -
resource tags
arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system -
submitted
10/06/2024, 20:30
Static task
static1
Behavioral task
behavioral1
Sample
setsgenerator.bat
Resource
win7-20240508-en
windows7-x64
7 signatures
150 seconds
Behavioral task
behavioral2
Sample
setsgenerator.bat
Resource
win10v2004-20240508-en
windows10-2004-x64
2 signatures
150 seconds
General
-
Target
setsgenerator.bat
-
Size
260B
-
MD5
2dc2832a11cd603f682c9a9fb48ca35c
-
SHA1
39cc5f6f67e992d2350e8d929b4abb482b90ef0b
-
SHA256
133149390cb34a5d4df68c907efe3d6997cc600cc30145081820a793475315b0
-
SHA512
3e4ee9585d2b2caefe2d812af1f7ea1004b51b0da11def6b938a3e2b310c7658a03040ea8c0505b9e6f1601376fa271fa1f5cdb6dfaff2d3c2f930cc6f5bab2f
Score
1/10
Malware Config
Signatures
-
Delays execution with timeout.exe 1 IoCs
pid Process 2780 timeout.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 3060 taskmgr.exe 3060 taskmgr.exe 3060 taskmgr.exe 3060 taskmgr.exe 3060 taskmgr.exe 3060 taskmgr.exe 3060 taskmgr.exe 3060 taskmgr.exe 3060 taskmgr.exe 3060 taskmgr.exe 3060 taskmgr.exe 3060 taskmgr.exe 3060 taskmgr.exe 3060 taskmgr.exe 3060 taskmgr.exe 3060 taskmgr.exe 3060 taskmgr.exe 3060 taskmgr.exe 3060 taskmgr.exe 3060 taskmgr.exe 3060 taskmgr.exe 3060 taskmgr.exe 3060 taskmgr.exe 3060 taskmgr.exe 3060 taskmgr.exe 3060 taskmgr.exe 3060 taskmgr.exe 3060 taskmgr.exe 3060 taskmgr.exe 3060 taskmgr.exe 3060 taskmgr.exe 3060 taskmgr.exe 3060 taskmgr.exe 3060 taskmgr.exe 3060 taskmgr.exe 3060 taskmgr.exe 3060 taskmgr.exe 3060 taskmgr.exe 3060 taskmgr.exe 3060 taskmgr.exe 3060 taskmgr.exe 3060 taskmgr.exe 3060 taskmgr.exe 3060 taskmgr.exe 3060 taskmgr.exe 3060 taskmgr.exe 3060 taskmgr.exe 3060 taskmgr.exe 3060 taskmgr.exe 3060 taskmgr.exe 3060 taskmgr.exe 3060 taskmgr.exe 3060 taskmgr.exe 3060 taskmgr.exe 3060 taskmgr.exe 3060 taskmgr.exe 3060 taskmgr.exe 3060 taskmgr.exe 3060 taskmgr.exe 3060 taskmgr.exe 3060 taskmgr.exe 3060 taskmgr.exe 3060 taskmgr.exe 3060 taskmgr.exe -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
pid Process 3060 taskmgr.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
description pid Process Token: SeDebugPrivilege 3060 taskmgr.exe -
Suspicious use of FindShellTrayWindow 64 IoCs
pid Process 3060 taskmgr.exe 3060 taskmgr.exe 3060 taskmgr.exe 3060 taskmgr.exe 3060 taskmgr.exe 3060 taskmgr.exe 3060 taskmgr.exe 3060 taskmgr.exe 3060 taskmgr.exe 3060 taskmgr.exe 3060 taskmgr.exe 3060 taskmgr.exe 3060 taskmgr.exe 3060 taskmgr.exe 3060 taskmgr.exe 3060 taskmgr.exe 3060 taskmgr.exe 3060 taskmgr.exe 3060 taskmgr.exe 3060 taskmgr.exe 3060 taskmgr.exe 3060 taskmgr.exe 3060 taskmgr.exe 3060 taskmgr.exe 3060 taskmgr.exe 3060 taskmgr.exe 3060 taskmgr.exe 3060 taskmgr.exe 3060 taskmgr.exe 3060 taskmgr.exe 3060 taskmgr.exe 3060 taskmgr.exe 3060 taskmgr.exe 3060 taskmgr.exe 3060 taskmgr.exe 3060 taskmgr.exe 3060 taskmgr.exe 3060 taskmgr.exe 3060 taskmgr.exe 3060 taskmgr.exe 3060 taskmgr.exe 3060 taskmgr.exe 3060 taskmgr.exe 3060 taskmgr.exe 3060 taskmgr.exe 3060 taskmgr.exe 3060 taskmgr.exe 3060 taskmgr.exe 3060 taskmgr.exe 3060 taskmgr.exe 3060 taskmgr.exe 3060 taskmgr.exe 3060 taskmgr.exe 3060 taskmgr.exe 3060 taskmgr.exe 3060 taskmgr.exe 3060 taskmgr.exe 3060 taskmgr.exe 3060 taskmgr.exe 3060 taskmgr.exe 3060 taskmgr.exe 3060 taskmgr.exe 3060 taskmgr.exe 3060 taskmgr.exe -
Suspicious use of SendNotifyMessage 64 IoCs
pid Process 3060 taskmgr.exe 3060 taskmgr.exe 3060 taskmgr.exe 3060 taskmgr.exe 3060 taskmgr.exe 3060 taskmgr.exe 3060 taskmgr.exe 3060 taskmgr.exe 3060 taskmgr.exe 3060 taskmgr.exe 3060 taskmgr.exe 3060 taskmgr.exe 3060 taskmgr.exe 3060 taskmgr.exe 3060 taskmgr.exe 3060 taskmgr.exe 3060 taskmgr.exe 3060 taskmgr.exe 3060 taskmgr.exe 3060 taskmgr.exe 3060 taskmgr.exe 3060 taskmgr.exe 3060 taskmgr.exe 3060 taskmgr.exe 3060 taskmgr.exe 3060 taskmgr.exe 3060 taskmgr.exe 3060 taskmgr.exe 3060 taskmgr.exe 3060 taskmgr.exe 3060 taskmgr.exe 3060 taskmgr.exe 3060 taskmgr.exe 3060 taskmgr.exe 3060 taskmgr.exe 3060 taskmgr.exe 3060 taskmgr.exe 3060 taskmgr.exe 3060 taskmgr.exe 3060 taskmgr.exe 3060 taskmgr.exe 3060 taskmgr.exe 3060 taskmgr.exe 3060 taskmgr.exe 3060 taskmgr.exe 3060 taskmgr.exe 3060 taskmgr.exe 3060 taskmgr.exe 3060 taskmgr.exe 3060 taskmgr.exe 3060 taskmgr.exe 3060 taskmgr.exe 3060 taskmgr.exe 3060 taskmgr.exe 3060 taskmgr.exe 3060 taskmgr.exe 3060 taskmgr.exe 3060 taskmgr.exe 3060 taskmgr.exe 3060 taskmgr.exe 3060 taskmgr.exe 3060 taskmgr.exe 3060 taskmgr.exe 3060 taskmgr.exe -
Suspicious use of WriteProcessMemory 6 IoCs
description pid Process procid_target PID 348 wrote to memory of 2268 348 cmd.exe 29 PID 348 wrote to memory of 2268 348 cmd.exe 29 PID 348 wrote to memory of 2268 348 cmd.exe 29 PID 348 wrote to memory of 2780 348 cmd.exe 30 PID 348 wrote to memory of 2780 348 cmd.exe 30 PID 348 wrote to memory of 2780 348 cmd.exe 30
Processes
-
C:\Windows\system32\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\setsgenerator.bat"1⤵
- Suspicious use of WriteProcessMemory
PID:348 -
C:\Windows\system32\mode.commode 502⤵PID:2268
-
-
C:\Windows\system32\timeout.exetimeout /t 102⤵
- Delays execution with timeout.exe
PID:2780
-
-
C:\Windows\system32\taskmgr.exe"C:\Windows\system32\taskmgr.exe" /41⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:3060