b6138bd31f0930d6f489ac8ef0dad8333b30bcebc51c0940b19ab4cb3ffbab73 | Triage™

Analysis

max time kernel
118s
max time network
119s
platform
windows7_x64
resource
win7-20240611-en
resource tags

arch:x64arch:x86image:win7-20240611-enlocale:en-usos:windows7-x64system
submitted
12/06/2024, 04:33

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
UninstallSystemTimeSyncService.bat
Size 72B
Sample240612-e6wkls1cnp
SHA256 ee7fa177b3262fd07801cb129b122cd42bc66e61f6b7f3b9b10a837c563d645a
MD5 266baae5a3f6cf8a9838dce0aa04fa87
SHA1 862c70a5d15778a8ec77dee6098ed169cb931cdc
SHA512 676affd8f44d6c26be5315bbaf016e70dd6ee5df6722684015e6c8fa83a62edf8c47d73d3f119666c19377f1ba33d0449662ed9001a564bc26f9d721bf035dee
MD5 SHA1 SHA512

Score

8^/10

evasion execution

Malware Config

Signatures

Stops running service(s) 4 TTPs
evasion execution

Windows Service
T1543.003

Impair Defenses
T1562

Service Stop
T1489

Service Execution
T1569.002

Launches sc.exe 2 IoCs

Sc.exe is a Windows utlilty to control services on the system.

pid	Process
2196	sc.exe
2320	sc.exe

Suspicious use of WriteProcessMemory 6 IoCs

description	pid	Process	procid_target
PID 2472 wrote to memory of 2196	2472	cmd.exe	29
PID 2472 wrote to memory of 2196	2472	cmd.exe	29
PID 2472 wrote to memory of 2196	2472	cmd.exe	29
PID 2472 wrote to memory of 2320	2472	cmd.exe	30
PID 2472 wrote to memory of 2320	2472	cmd.exe	30
PID 2472 wrote to memory of 2320	2472	cmd.exe	30

C:\Windows\system32\cmd.exe
cmd /c "C:\Users\Admin\AppData\Local\Temp\UninstallSystemTimeSyncService.bat"
1⤵
- Suspicious use of WriteProcessMemory
PID:2472
- C:\Windows\system32\sc.exe
  sc stop "╙┼╨º╚╒└·═°┬τ╩▒╝Σ═¼▓╜╖■╬±"
  2⤵
  - Launches sc.exe
  PID:2196
- C:\Windows\system32\sc.exe
  sc delete "╙┼╨º╚╒└·═°┬τ╩▒╝Σ═¼▓╜╖■╬±"
  2⤵
  - Launches sc.exe
  PID:2320

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

System Services

Service Execution

Persistence

Create or Modify System Process

Windows Service

Privilege Escalation

Create or Modify System Process

Windows Service

Defense Evasion

Impair Defenses

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Service Stop

Replay Monitor

Loading Replay Monitor...

Downloads