32f80f04d936215e00017d445f93489ddedb001a346c9ca04cdbbbd76c96b154

Analysis

max time kernel
146s
max time network
159s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
27-06-2024 22:23

Target

Pack de Optimizacion by bask1ngg/13. mantencion de disco/ssd.cmd
Size

1KB
MD5

4066662cd910be7283ccc4963b762ac1
SHA1

524ad1353b5d023c952b1207f0f2491e110124fc
SHA256

b84710ed8dc571ceb955b83ca1a7475d7d77ef59ff2d8a073ed90199fc1fda08
SHA512

dc7cb243600f30fa2a4a54701403a3ba5ce18f468fcc6f0ad9551690279bb1d1ac224346a91a82062f8a827a9a0bb2593fde0c2f493a9f36c2ad670ba91378b3

Score

10^/10

Disables service(s) 3 TTPs
evasion execution

Windows Service
T1543.003

Service Stop
T1489

Service Execution
T1569.002
Power Settings 1 TTPs 2 IoCs
powercfg controls all configurable power system settings on a Windows system and can be abused to prevent an infected host from locking or shutting down.
persistence

Power Settings
T1653

Processes:

powercfg.exepowercfg.exe

pid process

5420 powercfg.exe
4316 powercfg.exe
Launches sc.exe 1 IoCs
Sc.exe is a Windows utlilty to control services on the system.

Processes:

sc.exe

pid process

5620 sc.exe
Runs net.exe

pid	process
5420	powercfg.exe
4316	powercfg.exe

pid	process
5620	sc.exe

Suspicious use of AdjustPrivilegeToken 6 IoCs

Processes:

powercfg.exepowercfg.exe

description	pid	process
Token: SeShutdownPrivilege	5420	powercfg.exe
Token: SeCreatePagefilePrivilege	5420	powercfg.exe
Token: SeShutdownPrivilege	4316	powercfg.exe
Token: SeCreatePagefilePrivilege	4316	powercfg.exe
Token: SeShutdownPrivilege	4316	powercfg.exe
Token: SeCreatePagefilePrivilege	4316	powercfg.exe

Suspicious use of WriteProcessMemory 20 IoCs

Processes:

cmd.exenet.exe

description	pid	process	target process
PID 5800 wrote to memory of 2452	5800	cmd.exe	chcp.com
PID 5800 wrote to memory of 2452	5800	cmd.exe	chcp.com
PID 5800 wrote to memory of 2300	5800	cmd.exe	Defrag.exe
PID 5800 wrote to memory of 2300	5800	cmd.exe	Defrag.exe
PID 5800 wrote to memory of 5420	5800	cmd.exe	powercfg.exe
PID 5800 wrote to memory of 5420	5800	cmd.exe	powercfg.exe
PID 5800 wrote to memory of 1240	5800	cmd.exe	reg.exe
PID 5800 wrote to memory of 1240	5800	cmd.exe	reg.exe
PID 5800 wrote to memory of 2836	5800	cmd.exe	reg.exe
PID 5800 wrote to memory of 2836	5800	cmd.exe	reg.exe
PID 5800 wrote to memory of 5620	5800	cmd.exe	sc.exe
PID 5800 wrote to memory of 5620	5800	cmd.exe	sc.exe
PID 5800 wrote to memory of 5336	5800	cmd.exe	net.exe
PID 5800 wrote to memory of 5336	5800	cmd.exe	net.exe
PID 5336 wrote to memory of 4544	5336	net.exe	net1.exe
PID 5336 wrote to memory of 4544	5336	net.exe	net1.exe
PID 5800 wrote to memory of 3748	5800	cmd.exe	fsutil.exe
PID 5800 wrote to memory of 3748	5800	cmd.exe	fsutil.exe
PID 5800 wrote to memory of 4316	5800	cmd.exe	powercfg.exe
PID 5800 wrote to memory of 4316	5800	cmd.exe	powercfg.exe

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\Pack de Optimizacion by bask1ngg\13. mantencion de disco\ssd.cmd"
1⤵
- Suspicious use of WriteProcessMemory
PID:5800

C:\Windows\system32\reg.exe
reg add "HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Session Manager\Memory Management\PrefetchParameters" /v EnablePrefetcher /t REG_DWORD /d 0 /f
2⤵
PID:1240

C:\Windows\system32\reg.exe
reg add "HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Session Manager\Memory Management\PrefetchParameters" /v EnableSuperfetch /t REG_DWORD /d 0 /f
2⤵
PID:2836