b6138bd31f0930d6f489ac8ef0dad8333b30bcebc51c0940b19ab4cb3ffbab73

Analysis

max time kernel
51s
max time network
51s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
12/06/2024, 04:33

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

InstallSystemTimeSyncService.bat
Size

179B
MD5

a7064c6865c7e3c53d34c6eaf693aa03
SHA1

f000692f607e2cf6a88c8f68ea6d9313619d5356
SHA256

55c6a33051fdcd000084593d093ad02863fe97068609f27e8de16901935baf52
SHA512

837ce7186ce58ab18a25c45af571eba78048473745b309cbe54bac435a56dc77dc9d65f3f07645b8dde501a99c6157cd9caebbda27cfb3085f90e466c7fd9a90

Score

8^/10

execution persistence

Malware Config

Signatures

Creates new service(s) 2 TTPs
persistence execution

Windows Service
T1543.003

Service Execution
T1569.002

Launches sc.exe 3 IoCs

Sc.exe is a Windows utlilty to control services on the system.

pid	Process
4284	sc.exe
1000	sc.exe
216	sc.exe

Suspicious use of WriteProcessMemory 6 IoCs

description	pid	Process	procid_target
PID 2548 wrote to memory of 4284	2548	cmd.exe	85
PID 2548 wrote to memory of 4284	2548	cmd.exe	85
PID 2548 wrote to memory of 1000	2548	cmd.exe	86
PID 2548 wrote to memory of 1000	2548	cmd.exe	86
PID 2548 wrote to memory of 216	2548	cmd.exe	88
PID 2548 wrote to memory of 216	2548	cmd.exe	88

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\InstallSystemTimeSyncService.bat"
1⤵
- Suspicious use of WriteProcessMemory
PID:2548
- C:\Windows\system32\sc.exe
  sc create "╙┼╨º╚╒└·═°┬τ╩▒╝Σ═¼▓╜╖■╬±" binPath= "C:\Users\Admin\AppData\Local\Temp\\SystemTimeSyncService.exe"
  2⤵
  - Launches sc.exe
  PID:4284
- C:\Windows\system32\sc.exe
  sc start "╙┼╨º╚╒└·═°┬τ╩▒╝Σ═¼▓╜╖■╬±"
  2⤵
  - Launches sc.exe
  PID:1000
- C:\Windows\system32\sc.exe
  sc config "╙┼╨º╚╒└·═°┬τ╩▒╝Σ═¼▓╜╖■╬±" start= AUTO
  2⤵
  - Launches sc.exe
  PID:216

C:\Users\Admin\AppData\Local\Temp\SystemTimeSyncService.exe
C:\Users\Admin\AppData\Local\Temp\\SystemTimeSyncService.exe
1⤵
PID:1656

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

System Services

T1569

Service Execution

T1569.002

Persistence

Create or Modify System Process

T1543

Windows Service

T1543.003

Privilege Escalation

Create or Modify System Process

T1543

Windows Service

T1543.003

Defense Evasion

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads