Overview

overview

1

Static

static

1

test2.bat

windows10-2004-x64

Analysis

  • max time kernel
    144s
  • max time network
    145s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240611-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240611-enlocale:en-usos:windows10-2004-x64system
  • submitted
    15/06/2024, 11:35

Sharing

Copy URL Twitter E-mail

Errors

Reason
Machine shutdown
Report Analysis Logs

General

  • Target

    test2.bat

  • Size

    23B

  • MD5

    cb66443ab5a038dbbd9e15c1dc64d5c6

  • SHA1

    d1339ca1ab4ce8b716284d31b54ad4dd6408eaaa

  • SHA256

    8e7d12754a0a58b1f1f93cc8008279033242c367c71d3f8cee1af650bcc17d54

  • SHA512

    6196b82e3bb939ec4bdbaec1a64ea9fb030df341074c1af831f41bd80292eb2d15ce786a6ec5f0dc91413dfb63c1e9380a163bd07d0629c151c046bdf03e7dd0

Score
1/10

Malware Config

Signatures

  • Modifies data under HKEY_USERS 15 IoCs
  • Modifies registry class 33 IoCs
  • Suspicious use of AdjustPrivilegeToken 4 IoCs
  • Suspicious use of FindShellTrayWindow 1 IoCs
  • Suspicious use of SetWindowsHookEx 3 IoCs
  • Suspicious use of WriteProcessMemory 2 IoCs

Processes

  • C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\test2.bat"
    1⤵
      PID:4608
    • C:\Windows\system32\AUDIODG.EXE
      C:\Windows\system32\AUDIODG.EXE 0x4b4 0x154
      1⤵
      • Suspicious use of AdjustPrivilegeToken
      PID:1936
    • C:\Windows\system32\notepad.exe
      "C:\Windows\system32\notepad.exe"
      1⤵
      • Modifies registry class
      • Suspicious use of FindShellTrayWindow
      • Suspicious use of SetWindowsHookEx
      PID:1732
    • C:\Windows\System32\rundll32.exe
      C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
      1⤵
        PID:216
      • C:\Windows\system32\cmd.exe
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\Documents\lol.bat" "
        1⤵
        • Suspicious use of WriteProcessMemory
        PID:3796
        • C:\Windows\system32\shutdown.exe
          shutdown /r
          2⤵
          • Suspicious use of AdjustPrivilegeToken
          PID:2292
      • C:\Windows\system32\LogonUI.exe
        "LogonUI.exe" /flags:0x4 /state0:0xa3961055 /state1:0x41c64e6d
        1⤵
        • Modifies data under HKEY_USERS
        • Suspicious use of SetWindowsHookEx
        PID:2400

      Network

            MITRE ATT&CK Matrix

            Replay Monitor

            Loading Replay Monitor...

            Downloads

            • C:\Users\Admin\Documents\lol.bat
              Filesize

              24B

              MD5

              ee14d62d6662c9d94298246f130d05e2

              SHA1

              bcbbf5838a9a6b965917ea0bd3812373d8126e3f

              SHA256

              ce65a9bd448f19b5e4419272769f6e63f4249546bd1295a5c1870194360e5480

              SHA512

              3edf6f1e5e2c3c2e47101c94a896a683a54711a5e1200043650c184daf4be35ec10bf635ff71c28687cc0fa11a6f6c460f46e137c65607ff7aa3dd8a0700b319

              Download Submit