Analysis
- max time kernel
120s - max time network
120s - platform
windows7_x64 - resource
win7-20240508-en - resource tags
arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system - submitted
13/06/2024, 12:23
Static task
static1
Behavioral task
behavioral1
Sample
FN Cleaners/clean1.bat
Resource
win7-20240508-en
windows7-x64
6 signatures
150 seconds
Behavioral task
behavioral2
Sample
FN Cleaners/clean1.bat
Resource
win10v2004-20240611-en
windows10-2004-x64
5 signatures
150 seconds
Behavioral task
behavioral3
Sample
FN Cleaners/clean2.bat
Resource
win7-20240508-en
windows7-x64
6 signatures
150 seconds
Behavioral task
behavioral4
Sample
FN Cleaners/clean2.bat
Resource
win10v2004-20240508-en
windows10-2004-x64
5 signatures
150 seconds
Behavioral task
behavioral5
Sample
FN Cleaners/clean3.bat
Resource
win7-20240419-en
windows7-x64
1 signatures
150 seconds
Behavioral task
behavioral6
Sample
FN Cleaners/clean3.bat
Resource
win10v2004-20240508-en
windows10-2004-x64
0 signatures
150 seconds
General
- Target FN Cleaners/clean2.bat
- Size 265KB
- Sample240613-pkltdsycmd
- SHA256 a3c1a9061c4caddfa5023640eb8c33c3c99859320a8c3164e88facba9166bf35
- MD5 ce55c0703b6be160771e927ba9de028f
- SHA1 144d8889c6d21de0121e189ff3a3d9f607875faf
- SHA512 a71678d1aa93a98c82721b351bb52aa339d374070aa85bb2a5782ee499823234d9bfdca1736c14dcba3626365059798275a6e55864cb7253a1895c91e4b82fdf
- SSDEEP 1536:gwNoZxBOz2oofaCWfr3PwUWgM8361L5LvLpLjL5Gzf4oH9Gzf4gH9c:gLfaCWcUWgM+4oH9q4gH9c
- MD5 SHA1 SHA512 SSDEEP
Malware Config
Signatures
- Deletes itself 1 IoCs
pid Process 848 cmd.exe - Launches sc.exe 4 IoCs
Sc.exe is a Windows utlilty to control services on the system.
pid Process 2560 sc.exe 2740 sc.exe 1428 sc.exe 1448 sc.exe - Kills process with taskkill 15 IoCs
pid Process 2088 taskkill.exe 2728 taskkill.exe 2628 taskkill.exe 2844 taskkill.exe 2608 taskkill.exe 2756 taskkill.exe 2976 taskkill.exe 1068 taskkill.exe 1612 taskkill.exe 2648 taskkill.exe 2800 taskkill.exe 2672 taskkill.exe 2500 taskkill.exe 2544 taskkill.exe 1552 taskkill.exe - Suspicious use of AdjustPrivilegeToken 15 IoCs
description pid Process Token: SeDebugPrivilege 2088 taskkill.exe Token: SeDebugPrivilege 2608 taskkill.exe Token: SeDebugPrivilege 2648 taskkill.exe Token: SeDebugPrivilege 2728 taskkill.exe Token: SeDebugPrivilege 2628 taskkill.exe Token: SeDebugPrivilege 2844 taskkill.exe Token: SeDebugPrivilege 2756 taskkill.exe Token: SeDebugPrivilege 2800 taskkill.exe Token: SeDebugPrivilege 2672 taskkill.exe Token: SeDebugPrivilege 2500 taskkill.exe Token: SeDebugPrivilege 2544 taskkill.exe Token: SeDebugPrivilege 2976 taskkill.exe Token: SeDebugPrivilege 1068 taskkill.exe Token: SeDebugPrivilege 1612 taskkill.exe Token: SeDebugPrivilege 1552 taskkill.exe - Suspicious use of WriteProcessMemory 60 IoCs
description pid Process procid_target PID 848 wrote to memory of 2100 848 cmd.exe 29 PID 848 wrote to memory of 2100 848 cmd.exe 29 PID 848 wrote to memory of 2100 848 cmd.exe 29 PID 848 wrote to memory of 2088 848 cmd.exe 30 PID 848 wrote to memory of 2088 848 cmd.exe 30 PID 848 wrote to memory of 2088 848 cmd.exe 30 PID 848 wrote to memory of 2608 848 cmd.exe 32 PID 848 wrote to memory of 2608 848 cmd.exe 32 PID 848 wrote to memory of 2608 848 cmd.exe 32 PID 848 wrote to memory of 2648 848 cmd.exe 33 PID 848 wrote to memory of 2648 848 cmd.exe 33 PID 848 wrote to memory of 2648 848 cmd.exe 33 PID 848 wrote to memory of 2728 848 cmd.exe 34 PID 848 wrote to memory of 2728 848 cmd.exe 34 PID 848 wrote to memory of 2728 848 cmd.exe 34 PID 848 wrote to memory of 2628 848 cmd.exe 35 PID 848 wrote to memory of 2628 848 cmd.exe 35 PID 848 wrote to memory of 2628 848 cmd.exe 35 PID 848 wrote to memory of 2844 848 cmd.exe 36 PID 848 wrote to memory of 2844 848 cmd.exe 36 PID 848 wrote to memory of 2844 848 cmd.exe 36 PID 848 wrote to memory of 2756 848 cmd.exe 37 PID 848 wrote to memory of 2756 848 cmd.exe 37 PID 848 wrote to memory of 2756 848 cmd.exe 37 PID 848 wrote to memory of 2800 848 cmd.exe 38 PID 848 wrote to memory of 2800 848 cmd.exe 38 PID 848 wrote to memory of 2800 848 cmd.exe 38 PID 848 wrote to memory of 2672 848 cmd.exe 39 PID 848 wrote to memory of 2672 848 cmd.exe 39 PID 848 wrote to memory of 2672 848 cmd.exe 39 PID 848 wrote to memory of 2500 848 cmd.exe 40 PID 848 wrote to memory of 2500 848 cmd.exe 40 PID 848 wrote to memory of 2500 848 cmd.exe 40 PID 848 wrote to memory of 2544 848 cmd.exe 41 PID 848 wrote to memory of 2544 848 cmd.exe 41 PID 848 wrote to memory of 2544 848 cmd.exe 41 PID 848 wrote to memory of 2976 848 cmd.exe 42 PID 848 wrote to memory of 2976 848 cmd.exe 42 PID 848 wrote to memory of 2976 848 cmd.exe 42 PID 848 wrote to memory of 1068 848 cmd.exe 43 PID 848 wrote to memory of 1068 848 cmd.exe 43 PID 848 wrote to memory of 1068 848 cmd.exe 43 PID 848 wrote to memory of 1612 848 cmd.exe 44 PID 848 wrote to memory of 1612 848 cmd.exe 44 PID 848 wrote to memory of 1612 848 cmd.exe 44 PID 848 wrote to memory of 1552 848 cmd.exe 45 PID 848 wrote to memory of 1552 848 cmd.exe 45 PID 848 wrote to memory of 1552 848 cmd.exe 45 PID 848 wrote to memory of 1428 848 cmd.exe 46 PID 848 wrote to memory of 1428 848 cmd.exe 46 PID 848 wrote to memory of 1428 848 cmd.exe 46 PID 848 wrote to memory of 1448 848 cmd.exe 47 PID 848 wrote to memory of 1448 848 cmd.exe 47 PID 848 wrote to memory of 1448 848 cmd.exe 47 PID 848 wrote to memory of 2560 848 cmd.exe 48 PID 848 wrote to memory of 2560 848 cmd.exe 48 PID 848 wrote to memory of 2560 848 cmd.exe 48 PID 848 wrote to memory of 2740 848 cmd.exe 49 PID 848 wrote to memory of 2740 848 cmd.exe 49 PID 848 wrote to memory of 2740 848 cmd.exe 49
Processes
-
C:\Windows\system32\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\FN Cleaners\clean2.bat"1⤵
- Deletes itself
- Suspicious use of WriteProcessMemory
PID:848 -
C:\Windows\system32\cacls.exe"C:\Windows\system32\cacls.exe" "C:\Windows\system32\config\system"2⤵PID:2100
-
-
C:\Windows\system32\taskkill.exetaskkill /f /im epicgameslauncher.exe2⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:2088
-
-
C:\Windows\system32\taskkill.exetaskkill /f /im FortniteClient-Win64-Shipping_EAC.exe2⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:2608
-
-
C:\Windows\system32\taskkill.exetaskkill /f /im FortniteClient-Win64-Shipping_BE.exe2⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:2648
-
-
C:\Windows\system32\taskkill.exetaskkill /f /im FortniteLauncher.exe2⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:2728
-
-
C:\Windows\system32\taskkill.exetaskkill /f /im OneDrive.exe2⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:2628
-
-
C:\Windows\system32\taskkill.exetaskkill /f /im FortniteClient-Win64-Shipping.exe2⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:2844
-
-
C:\Windows\system32\taskkill.exetaskkill /f /im EpicGamesLauncher.exe2⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:2756
-
-
C:\Windows\system32\taskkill.exetaskkill /f /im UnrealCEFSubProcess.exe2⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:2800
-
-
C:\Windows\system32\taskkill.exetaskkill /f /im CEFProcess.exe2⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:2672
-
-
C:\Windows\system32\taskkill.exetaskkill /f /im EasyAntiCheat.exe2⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:2500
-
-
C:\Windows\system32\taskkill.exetaskkill /f /im BEService.exe2⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:2544
-
-
C:\Windows\system32\taskkill.exetaskkill /f /im BEServices.exe2⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:2976
-
-
C:\Windows\system32\taskkill.exetaskkill /f /im BattleEye.exe2⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:1068
-
-
C:\Windows\system32\taskkill.exetaskkill /f /im PerfWatson2.exe2⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:1612
-
-
C:\Windows\system32\taskkill.exetaskkill /f /im vgtray.exe2⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:1552
-
-
C:\Windows\system32\sc.exeSc stop EasyAntiCheat2⤵
- Launches sc.exe
PID:1428
-
-
C:\Windows\system32\sc.exeSc stop FortniteClient-Win64-Shipping_EAC2⤵
- Launches sc.exe
PID:1448
-
-
C:\Windows\system32\sc.exeSc stop BattleEye2⤵
- Launches sc.exe
PID:2560
-
-
C:\Windows\system32\sc.exeSc stop FortniteClient-Win64-Shipping_BE2⤵
- Launches sc.exe
PID:2740
-