b6138bd31f0930d6f489ac8ef0dad8333b30bcebc51c0940b19ab4cb3ffbab73 | Triage

Analysis

max time kernel
92s
max time network
122s
platform
windows10-2004_x64
resource
win10v2004-20240611-en
resource tags

arch:x64arch:x86image:win10v2004-20240611-enlocale:en-usos:windows10-2004-x64system
submitted
12-06-2024 04:33

Sharing

Report Analysis Logs

General

Target

UninstallSystemTimeSyncService.bat
Size

72B
MD5

266baae5a3f6cf8a9838dce0aa04fa87
SHA1

862c70a5d15778a8ec77dee6098ed169cb931cdc
SHA256

ee7fa177b3262fd07801cb129b122cd42bc66e61f6b7f3b9b10a837c563d645a
SHA512

676affd8f44d6c26be5315bbaf016e70dd6ee5df6722684015e6c8fa83a62edf8c47d73d3f119666c19377f1ba33d0449662ed9001a564bc26f9d721bf035dee

Score

8^/10

evasion execution

Malware Config

Signatures

Stops running service(s) 4 TTPs
evasion execution

Windows Service
T1543.003

Impair Defenses
T1562

Service Stop
T1489

Service Execution
T1569.002
Launches sc.exe 2 IoCs
Sc.exe is a Windows utlilty to control services on the system.

Processes:

sc.exesc.exe

pid process

1924 sc.exe
692 sc.exe

Suspicious use of WriteProcessMemory 4 IoCs

Processes:

cmd.exe

description	pid	process	target process
PID 2516 wrote to memory of 692	2516	cmd.exe	sc.exe
PID 2516 wrote to memory of 692	2516	cmd.exe	sc.exe
PID 2516 wrote to memory of 1924	2516	cmd.exe	sc.exe
PID 2516 wrote to memory of 1924	2516	cmd.exe	sc.exe

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\UninstallSystemTimeSyncService.bat"
1⤵
- Suspicious use of WriteProcessMemory
PID:2516

C:\Windows\system32\sc.exe
sc stop "╙┼╨º╚╒└·═°┬τ╩▒╝Σ═¼▓╜╖■╬±"
2⤵
- Launches sc.exe
PID:692

C:\Windows\system32\sc.exe
sc delete "╙┼╨º╚╒└·═°┬τ╩▒╝Σ═¼▓╜╖■╬±"
2⤵
- Launches sc.exe
PID:1924

Network

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

System Services

Service Execution

Persistence

Create or Modify System Process

Windows Service

Privilege Escalation

Create or Modify System Process

Windows Service

Defense Evasion

Impair Defenses

Credential Access

Discovery

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Service Stop

Resource Development

Reconnaissance

Replay Monitor

Loading Replay Monitor...