02d3b89a95b85e771778e723adf7d9bba0509047d00f43fc2e9f26188c88a16a

Analysis

max time kernel
118s
max time network
123s
platform
windows7_x64
resource
win7-20240611-en
resource tags

arch:x64arch:x86image:win7-20240611-enlocale:en-usos:windows7-x64system
submitted
24-06-2024 16:16

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

UnBan Guide/step 6/2. SerialsChecker.bat
Size

573B
MD5

6a896cfd61884e9b42f78b270e5c22cf
SHA1

f228f1b281724015b9460969381af9a1afe06046
SHA256

5cd676d9bc7e707ad7e8dc48dabf9af733c81d1b836486ff5eb9d44cba788e46
SHA512

17982e060867e323fe83908b4735f44e5fc8353608c50f3c6e9ee5c3b97643045d764f21eb402b9b3fbee0e19669391b6eab6dc0bf28e92bb1fb4a898a668eb9

Score

1^/10

Malware Config

Signatures

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeIncreaseQuotaPrivilege	2140	WMIC.exe
Token: SeSecurityPrivilege	2140	WMIC.exe
Token: SeTakeOwnershipPrivilege	2140	WMIC.exe
Token: SeLoadDriverPrivilege	2140	WMIC.exe
Token: SeSystemProfilePrivilege	2140	WMIC.exe
Token: SeSystemtimePrivilege	2140	WMIC.exe
Token: SeProfSingleProcessPrivilege	2140	WMIC.exe
Token: SeIncBasePriorityPrivilege	2140	WMIC.exe
Token: SeCreatePagefilePrivilege	2140	WMIC.exe
Token: SeBackupPrivilege	2140	WMIC.exe
Token: SeRestorePrivilege	2140	WMIC.exe
Token: SeShutdownPrivilege	2140	WMIC.exe
Token: SeDebugPrivilege	2140	WMIC.exe
Token: SeSystemEnvironmentPrivilege	2140	WMIC.exe
Token: SeRemoteShutdownPrivilege	2140	WMIC.exe
Token: SeUndockPrivilege	2140	WMIC.exe
Token: SeManageVolumePrivilege	2140	WMIC.exe
Token: 33	2140	WMIC.exe
Token: 34	2140	WMIC.exe
Token: 35	2140	WMIC.exe
Token: SeIncreaseQuotaPrivilege	2140	WMIC.exe
Token: SeSecurityPrivilege	2140	WMIC.exe
Token: SeTakeOwnershipPrivilege	2140	WMIC.exe
Token: SeLoadDriverPrivilege	2140	WMIC.exe
Token: SeSystemProfilePrivilege	2140	WMIC.exe
Token: SeSystemtimePrivilege	2140	WMIC.exe
Token: SeProfSingleProcessPrivilege	2140	WMIC.exe
Token: SeIncBasePriorityPrivilege	2140	WMIC.exe
Token: SeCreatePagefilePrivilege	2140	WMIC.exe
Token: SeBackupPrivilege	2140	WMIC.exe
Token: SeRestorePrivilege	2140	WMIC.exe
Token: SeShutdownPrivilege	2140	WMIC.exe
Token: SeDebugPrivilege	2140	WMIC.exe
Token: SeSystemEnvironmentPrivilege	2140	WMIC.exe
Token: SeRemoteShutdownPrivilege	2140	WMIC.exe
Token: SeUndockPrivilege	2140	WMIC.exe
Token: SeManageVolumePrivilege	2140	WMIC.exe
Token: 33	2140	WMIC.exe
Token: 34	2140	WMIC.exe
Token: 35	2140	WMIC.exe
Token: SeIncreaseQuotaPrivilege	2712	WMIC.exe
Token: SeSecurityPrivilege	2712	WMIC.exe
Token: SeTakeOwnershipPrivilege	2712	WMIC.exe
Token: SeLoadDriverPrivilege	2712	WMIC.exe
Token: SeSystemProfilePrivilege	2712	WMIC.exe
Token: SeSystemtimePrivilege	2712	WMIC.exe
Token: SeProfSingleProcessPrivilege	2712	WMIC.exe
Token: SeIncBasePriorityPrivilege	2712	WMIC.exe
Token: SeCreatePagefilePrivilege	2712	WMIC.exe
Token: SeBackupPrivilege	2712	WMIC.exe
Token: SeRestorePrivilege	2712	WMIC.exe
Token: SeShutdownPrivilege	2712	WMIC.exe
Token: SeDebugPrivilege	2712	WMIC.exe
Token: SeSystemEnvironmentPrivilege	2712	WMIC.exe
Token: SeRemoteShutdownPrivilege	2712	WMIC.exe
Token: SeUndockPrivilege	2712	WMIC.exe
Token: SeManageVolumePrivilege	2712	WMIC.exe
Token: 33	2712	WMIC.exe
Token: 34	2712	WMIC.exe
Token: 35	2712	WMIC.exe
Token: SeIncreaseQuotaPrivilege	2712	WMIC.exe
Token: SeSecurityPrivilege	2712	WMIC.exe
Token: SeTakeOwnershipPrivilege	2712	WMIC.exe
Token: SeLoadDriverPrivilege	2712	WMIC.exe

Suspicious use of WriteProcessMemory 27 IoCs

description	pid	Process	procid_target
PID 2928 wrote to memory of 3020	2928	cmd.exe	29
PID 2928 wrote to memory of 3020	2928	cmd.exe	29
PID 2928 wrote to memory of 3020	2928	cmd.exe	29
PID 2928 wrote to memory of 2140	2928	cmd.exe	30
PID 2928 wrote to memory of 2140	2928	cmd.exe	30
PID 2928 wrote to memory of 2140	2928	cmd.exe	30
PID 2928 wrote to memory of 2712	2928	cmd.exe	32
PID 2928 wrote to memory of 2712	2928	cmd.exe	32
PID 2928 wrote to memory of 2712	2928	cmd.exe	32
PID 2928 wrote to memory of 2620	2928	cmd.exe	33
PID 2928 wrote to memory of 2620	2928	cmd.exe	33
PID 2928 wrote to memory of 2620	2928	cmd.exe	33
PID 2928 wrote to memory of 2604	2928	cmd.exe	34
PID 2928 wrote to memory of 2604	2928	cmd.exe	34
PID 2928 wrote to memory of 2604	2928	cmd.exe	34
PID 2928 wrote to memory of 2588	2928	cmd.exe	35
PID 2928 wrote to memory of 2588	2928	cmd.exe	35
PID 2928 wrote to memory of 2588	2928	cmd.exe	35
PID 2928 wrote to memory of 2692	2928	cmd.exe	36
PID 2928 wrote to memory of 2692	2928	cmd.exe	36
PID 2928 wrote to memory of 2692	2928	cmd.exe	36
PID 2928 wrote to memory of 2636	2928	cmd.exe	37
PID 2928 wrote to memory of 2636	2928	cmd.exe	37
PID 2928 wrote to memory of 2636	2928	cmd.exe	37
PID 2928 wrote to memory of 2464	2928	cmd.exe	38
PID 2928 wrote to memory of 2464	2928	cmd.exe	38
PID 2928 wrote to memory of 2464	2928	cmd.exe	38

C:\Windows\system32\cmd.exe
cmd /c "C:\Users\Admin\AppData\Local\Temp\UnBan Guide\step 6\2. SerialsChecker.bat"
1⤵
- Suspicious use of WriteProcessMemory
PID:2928
- C:\Windows\system32\mode.com
  mode con: cols=70 lines=35
  2⤵
  PID:3020
- C:\Windows\System32\Wbem\WMIC.exe
  wmic bios get serialnumber
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  PID:2140
- C:\Windows\System32\Wbem\WMIC.exe
  wmic csproduct get uuid
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  PID:2712
- C:\Windows\System32\Wbem\WMIC.exe
  wmic cpu get serialnumber
  2⤵
  PID:2620
- C:\Windows\System32\Wbem\WMIC.exe
  wmic cpu get processorid
  2⤵
  PID:2604
- C:\Windows\System32\Wbem\WMIC.exe
  wmic diskdrive get serialnumber
  2⤵
  PID:2588
- C:\Windows\System32\Wbem\WMIC.exe
  wmic baseboard get serialnumber
  2⤵
  PID:2692
- C:\Windows\System32\Wbem\WMIC.exe
  wmic baseboard get manufacturer
  2⤵
  PID:2636
- C:\Windows\System32\Wbem\WMIC.exe
  wmic path Win32_NetworkAdapter where "PNPDeviceID like '%PCI%' AND NetConnectionStatus=2 AND AdapterTypeID='0'" get MacAddress
  2⤵
  PID:2464

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads