292e3bb7d04e2037c045a424f7eba41036d6f6a7d1535bf43b2e034494185b69

Analysis

max time kernel
51s
max time network
52s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
13/06/2024, 12:23

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
FN Cleaners/clean2.bat
Size 265KB
Sample240613-pkltdsycmd
SHA256 a3c1a9061c4caddfa5023640eb8c33c3c99859320a8c3164e88facba9166bf35
MD5 ce55c0703b6be160771e927ba9de028f
SHA1 144d8889c6d21de0121e189ff3a3d9f607875faf
SHA512 a71678d1aa93a98c82721b351bb52aa339d374070aa85bb2a5782ee499823234d9bfdca1736c14dcba3626365059798275a6e55864cb7253a1895c91e4b82fdf
SSDEEP 1536:gwNoZxBOz2oofaCWfr3PwUWgM8361L5LvLpLjL5Gzf4oH9Gzf4gH9c:gLfaCWcUWgM+4oH9q4gH9c
MD5 SHA1 SHA512 SSDEEP

Score

8^/10

evasion execution

Malware Config

Signatures

Stops running service(s) 4 TTPs
evasion execution

Windows Service
T1543.003

Impair Defenses
T1562

Service Stop
T1489

Service Execution
T1569.002

Launches sc.exe 4 IoCs

Sc.exe is a Windows utlilty to control services on the system.

pid	Process
1816	sc.exe
4656	sc.exe
4192	sc.exe
1464	sc.exe

Kills process with taskkill 15 IoCs

evasion

pid	Process
1664	taskkill.exe
836	taskkill.exe
232	taskkill.exe
3528	taskkill.exe
3764	taskkill.exe
3708	taskkill.exe
396	taskkill.exe
3600	taskkill.exe
4724	taskkill.exe
3696	taskkill.exe
1176	taskkill.exe
4836	taskkill.exe
1072	taskkill.exe
1092	taskkill.exe
4956	taskkill.exe

Suspicious use of AdjustPrivilegeToken 15 IoCs

description	pid	Process
Token: SeDebugPrivilege	1092	taskkill.exe
Token: SeDebugPrivilege	3708	taskkill.exe
Token: SeDebugPrivilege	232	taskkill.exe
Token: SeDebugPrivilege	396	taskkill.exe
Token: SeDebugPrivilege	4956	taskkill.exe
Token: SeDebugPrivilege	4836	taskkill.exe
Token: SeDebugPrivilege	1072	taskkill.exe
Token: SeDebugPrivilege	3528	taskkill.exe
Token: SeDebugPrivilege	3696	taskkill.exe
Token: SeDebugPrivilege	3764	taskkill.exe
Token: SeDebugPrivilege	1176	taskkill.exe
Token: SeDebugPrivilege	3600	taskkill.exe
Token: SeDebugPrivilege	1664	taskkill.exe
Token: SeDebugPrivilege	4724	taskkill.exe
Token: SeDebugPrivilege	836	taskkill.exe

Suspicious use of WriteProcessMemory 40 IoCs

description	pid	Process	procid_target
PID 1800 wrote to memory of 2476	1800	cmd.exe	83
PID 1800 wrote to memory of 2476	1800	cmd.exe	83
PID 1800 wrote to memory of 1092	1800	cmd.exe	84
PID 1800 wrote to memory of 1092	1800	cmd.exe	84
PID 1800 wrote to memory of 3708	1800	cmd.exe	86
PID 1800 wrote to memory of 3708	1800	cmd.exe	86
PID 1800 wrote to memory of 232	1800	cmd.exe	87
PID 1800 wrote to memory of 232	1800	cmd.exe	87
PID 1800 wrote to memory of 396	1800	cmd.exe	89
PID 1800 wrote to memory of 396	1800	cmd.exe	89
PID 1800 wrote to memory of 4956	1800	cmd.exe	90
PID 1800 wrote to memory of 4956	1800	cmd.exe	90
PID 1800 wrote to memory of 4836	1800	cmd.exe	92
PID 1800 wrote to memory of 4836	1800	cmd.exe	92
PID 1800 wrote to memory of 1072	1800	cmd.exe	93
PID 1800 wrote to memory of 1072	1800	cmd.exe	93
PID 1800 wrote to memory of 3528	1800	cmd.exe	94
PID 1800 wrote to memory of 3528	1800	cmd.exe	94
PID 1800 wrote to memory of 3696	1800	cmd.exe	96
PID 1800 wrote to memory of 3696	1800	cmd.exe	96
PID 1800 wrote to memory of 3764	1800	cmd.exe	97
PID 1800 wrote to memory of 3764	1800	cmd.exe	97
PID 1800 wrote to memory of 1176	1800	cmd.exe	98
PID 1800 wrote to memory of 1176	1800	cmd.exe	98
PID 1800 wrote to memory of 3600	1800	cmd.exe	99
PID 1800 wrote to memory of 3600	1800	cmd.exe	99
PID 1800 wrote to memory of 1664	1800	cmd.exe	100
PID 1800 wrote to memory of 1664	1800	cmd.exe	100
PID 1800 wrote to memory of 4724	1800	cmd.exe	101
PID 1800 wrote to memory of 4724	1800	cmd.exe	101
PID 1800 wrote to memory of 836	1800	cmd.exe	102
PID 1800 wrote to memory of 836	1800	cmd.exe	102
PID 1800 wrote to memory of 4656	1800	cmd.exe	103
PID 1800 wrote to memory of 4656	1800	cmd.exe	103
PID 1800 wrote to memory of 4192	1800	cmd.exe	104
PID 1800 wrote to memory of 4192	1800	cmd.exe	104
PID 1800 wrote to memory of 1464	1800	cmd.exe	105
PID 1800 wrote to memory of 1464	1800	cmd.exe	105
PID 1800 wrote to memory of 1816	1800	cmd.exe	106
PID 1800 wrote to memory of 1816	1800	cmd.exe	106

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\FN Cleaners\clean2.bat"
1⤵
- Suspicious use of WriteProcessMemory
PID:1800
- C:\Windows\system32\cacls.exe
  "C:\Windows\system32\cacls.exe" "C:\Windows\system32\config\system"
  2⤵
  PID:2476
- C:\Windows\system32\taskkill.exe
  taskkill /f /im epicgameslauncher.exe
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:1092
- C:\Windows\system32\taskkill.exe
  taskkill /f /im FortniteClient-Win64-Shipping_EAC.exe
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:3708
- C:\Windows\system32\taskkill.exe
  taskkill /f /im FortniteClient-Win64-Shipping_BE.exe
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:232
- C:\Windows\system32\taskkill.exe
  taskkill /f /im FortniteLauncher.exe
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:396
- C:\Windows\system32\taskkill.exe
  taskkill /f /im OneDrive.exe
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:4956
- C:\Windows\system32\taskkill.exe
  taskkill /f /im FortniteClient-Win64-Shipping.exe
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:4836
- C:\Windows\system32\taskkill.exe
  taskkill /f /im EpicGamesLauncher.exe
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:1072
- C:\Windows\system32\taskkill.exe
  taskkill /f /im UnrealCEFSubProcess.exe
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:3528
- C:\Windows\system32\taskkill.exe
  taskkill /f /im CEFProcess.exe
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:3696
- C:\Windows\system32\taskkill.exe
  taskkill /f /im EasyAntiCheat.exe
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:3764
- C:\Windows\system32\taskkill.exe
  taskkill /f /im BEService.exe
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:1176
- C:\Windows\system32\taskkill.exe
  taskkill /f /im BEServices.exe
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:3600
- C:\Windows\system32\taskkill.exe
  taskkill /f /im BattleEye.exe
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:1664
- C:\Windows\system32\taskkill.exe
  taskkill /f /im PerfWatson2.exe
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:4724
- C:\Windows\system32\taskkill.exe
  taskkill /f /im vgtray.exe
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:836
- C:\Windows\system32\sc.exe
  Sc stop EasyAntiCheat
  2⤵
  - Launches sc.exe
  PID:4656
- C:\Windows\system32\sc.exe
  Sc stop FortniteClient-Win64-Shipping_EAC
  2⤵
  - Launches sc.exe
  PID:4192
- C:\Windows\system32\sc.exe
  Sc stop BattleEye
  2⤵
  - Launches sc.exe
  PID:1464
- C:\Windows\system32\sc.exe
  Sc stop FortniteClient-Win64-Shipping_BE
  2⤵
  - Launches sc.exe
  PID:1816