02d3b89a95b85e771778e723adf7d9bba0509047d00f43fc2e9f26188c88a16a

Analysis

max time kernel
51s
max time network
60s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
24/06/2024, 16:16

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

UnBan Guide/step 6/2. SerialsChecker.bat
Size

573B
MD5

6a896cfd61884e9b42f78b270e5c22cf
SHA1

f228f1b281724015b9460969381af9a1afe06046
SHA256

5cd676d9bc7e707ad7e8dc48dabf9af733c81d1b836486ff5eb9d44cba788e46
SHA512

17982e060867e323fe83908b4735f44e5fc8353608c50f3c6e9ee5c3b97643045d764f21eb402b9b3fbee0e19669391b6eab6dc0bf28e92bb1fb4a898a668eb9

Score

1^/10

Malware Config

Signatures

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeIncreaseQuotaPrivilege	3668	WMIC.exe
Token: SeSecurityPrivilege	3668	WMIC.exe
Token: SeTakeOwnershipPrivilege	3668	WMIC.exe
Token: SeLoadDriverPrivilege	3668	WMIC.exe
Token: SeSystemProfilePrivilege	3668	WMIC.exe
Token: SeSystemtimePrivilege	3668	WMIC.exe
Token: SeProfSingleProcessPrivilege	3668	WMIC.exe
Token: SeIncBasePriorityPrivilege	3668	WMIC.exe
Token: SeCreatePagefilePrivilege	3668	WMIC.exe
Token: SeBackupPrivilege	3668	WMIC.exe
Token: SeRestorePrivilege	3668	WMIC.exe
Token: SeShutdownPrivilege	3668	WMIC.exe
Token: SeDebugPrivilege	3668	WMIC.exe
Token: SeSystemEnvironmentPrivilege	3668	WMIC.exe
Token: SeRemoteShutdownPrivilege	3668	WMIC.exe
Token: SeUndockPrivilege	3668	WMIC.exe
Token: SeManageVolumePrivilege	3668	WMIC.exe
Token: 33	3668	WMIC.exe
Token: 34	3668	WMIC.exe
Token: 35	3668	WMIC.exe
Token: 36	3668	WMIC.exe
Token: SeIncreaseQuotaPrivilege	3668	WMIC.exe
Token: SeSecurityPrivilege	3668	WMIC.exe
Token: SeTakeOwnershipPrivilege	3668	WMIC.exe
Token: SeLoadDriverPrivilege	3668	WMIC.exe
Token: SeSystemProfilePrivilege	3668	WMIC.exe
Token: SeSystemtimePrivilege	3668	WMIC.exe
Token: SeProfSingleProcessPrivilege	3668	WMIC.exe
Token: SeIncBasePriorityPrivilege	3668	WMIC.exe
Token: SeCreatePagefilePrivilege	3668	WMIC.exe
Token: SeBackupPrivilege	3668	WMIC.exe
Token: SeRestorePrivilege	3668	WMIC.exe
Token: SeShutdownPrivilege	3668	WMIC.exe
Token: SeDebugPrivilege	3668	WMIC.exe
Token: SeSystemEnvironmentPrivilege	3668	WMIC.exe
Token: SeRemoteShutdownPrivilege	3668	WMIC.exe
Token: SeUndockPrivilege	3668	WMIC.exe
Token: SeManageVolumePrivilege	3668	WMIC.exe
Token: 33	3668	WMIC.exe
Token: 34	3668	WMIC.exe
Token: 35	3668	WMIC.exe
Token: 36	3668	WMIC.exe
Token: SeIncreaseQuotaPrivilege	1144	WMIC.exe
Token: SeSecurityPrivilege	1144	WMIC.exe
Token: SeTakeOwnershipPrivilege	1144	WMIC.exe
Token: SeLoadDriverPrivilege	1144	WMIC.exe
Token: SeSystemProfilePrivilege	1144	WMIC.exe
Token: SeSystemtimePrivilege	1144	WMIC.exe
Token: SeProfSingleProcessPrivilege	1144	WMIC.exe
Token: SeIncBasePriorityPrivilege	1144	WMIC.exe
Token: SeCreatePagefilePrivilege	1144	WMIC.exe
Token: SeBackupPrivilege	1144	WMIC.exe
Token: SeRestorePrivilege	1144	WMIC.exe
Token: SeShutdownPrivilege	1144	WMIC.exe
Token: SeDebugPrivilege	1144	WMIC.exe
Token: SeSystemEnvironmentPrivilege	1144	WMIC.exe
Token: SeRemoteShutdownPrivilege	1144	WMIC.exe
Token: SeUndockPrivilege	1144	WMIC.exe
Token: SeManageVolumePrivilege	1144	WMIC.exe
Token: 33	1144	WMIC.exe
Token: 34	1144	WMIC.exe
Token: 35	1144	WMIC.exe
Token: 36	1144	WMIC.exe
Token: SeIncreaseQuotaPrivilege	1144	WMIC.exe

Suspicious use of WriteProcessMemory 18 IoCs

description	pid	Process	procid_target
PID 4620 wrote to memory of 3424	4620	cmd.exe	83
PID 4620 wrote to memory of 3424	4620	cmd.exe	83
PID 4620 wrote to memory of 3668	4620	cmd.exe	84
PID 4620 wrote to memory of 3668	4620	cmd.exe	84
PID 4620 wrote to memory of 1144	4620	cmd.exe	86
PID 4620 wrote to memory of 1144	4620	cmd.exe	86
PID 4620 wrote to memory of 4820	4620	cmd.exe	87
PID 4620 wrote to memory of 4820	4620	cmd.exe	87
PID 4620 wrote to memory of 180	4620	cmd.exe	88
PID 4620 wrote to memory of 180	4620	cmd.exe	88
PID 4620 wrote to memory of 5036	4620	cmd.exe	89
PID 4620 wrote to memory of 5036	4620	cmd.exe	89
PID 4620 wrote to memory of 4716	4620	cmd.exe	90
PID 4620 wrote to memory of 4716	4620	cmd.exe	90
PID 4620 wrote to memory of 2416	4620	cmd.exe	91
PID 4620 wrote to memory of 2416	4620	cmd.exe	91
PID 4620 wrote to memory of 1420	4620	cmd.exe	92
PID 4620 wrote to memory of 1420	4620	cmd.exe	92

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\UnBan Guide\step 6\2. SerialsChecker.bat"
1⤵
- Suspicious use of WriteProcessMemory
PID:4620
- C:\Windows\system32\mode.com
  mode con: cols=70 lines=35
  2⤵
  PID:3424
- C:\Windows\System32\Wbem\WMIC.exe
  wmic bios get serialnumber
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  PID:3668
- C:\Windows\System32\Wbem\WMIC.exe
  wmic csproduct get uuid
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  PID:1144
- C:\Windows\System32\Wbem\WMIC.exe
  wmic cpu get serialnumber
  2⤵
  PID:4820
- C:\Windows\System32\Wbem\WMIC.exe
  wmic cpu get processorid
  2⤵
  PID:180
- C:\Windows\System32\Wbem\WMIC.exe
  wmic diskdrive get serialnumber
  2⤵
  PID:5036
- C:\Windows\System32\Wbem\WMIC.exe
  wmic baseboard get serialnumber
  2⤵
  PID:4716
- C:\Windows\System32\Wbem\WMIC.exe
  wmic baseboard get manufacturer
  2⤵
  PID:2416
- C:\Windows\System32\Wbem\WMIC.exe
  wmic path Win32_NetworkAdapter where "PNPDeviceID like '%PCI%' AND NetConnectionStatus=2 AND AdapterTypeID='0'" get MacAddress
  2⤵
  PID:1420

Windows 7 deprecation

Loading Replay Monitor...

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads