2b40d424237ca996aeb4106ede91f3a831dc106781f7f79196fe10b9efbe98de

Analysis

max time kernel
121s
max time network
126s
platform
windows7_x64
resource
win7-20240508-en
resource tags

arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system
submitted
01/07/2024, 01:29

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

!!BEST TWEAKS/Windows Post-Installation Pack/1 Disable WUs/2 Disable WUs.cmd
Size

763B
MD5

4d7ad463f41e3489cfa8ec4327a67166
SHA1

b6424856de31b9bf49b2f354186e7f8598802b3b
SHA256

35e2e4cfae6c8e936cef2b3cf2ce179687eef3ad89e8746e81cc228b5588a090
SHA512

01bcc635644cfaf1f8673098b301e0d25e9adabb1b5c3b448041f1edf5bf43c82e2286c992079407916a875d5a9d1c1f152779883e456626a3940d20aec173d6

Score

1^/10

Malware Config

Signatures

Kills process with taskkill 1 IoCs

evasion

pid	Process
352	taskkill.exe

Runs net.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	352	taskkill.exe

Suspicious use of WriteProcessMemory 42 IoCs

description	pid	Process	procid_target
PID 2212 wrote to memory of 352	2212	cmd.exe	29
PID 2212 wrote to memory of 352	2212	cmd.exe	29
PID 2212 wrote to memory of 352	2212	cmd.exe	29
PID 2212 wrote to memory of 2996	2212	cmd.exe	31
PID 2212 wrote to memory of 2996	2212	cmd.exe	31
PID 2212 wrote to memory of 2996	2212	cmd.exe	31
PID 2996 wrote to memory of 2584	2996	net.exe	32
PID 2996 wrote to memory of 2584	2996	net.exe	32
PID 2996 wrote to memory of 2584	2996	net.exe	32
PID 2212 wrote to memory of 2132	2212	cmd.exe	33
PID 2212 wrote to memory of 2132	2212	cmd.exe	33
PID 2212 wrote to memory of 2132	2212	cmd.exe	33
PID 2132 wrote to memory of 3052	2132	net.exe	34
PID 2132 wrote to memory of 3052	2132	net.exe	34
PID 2132 wrote to memory of 3052	2132	net.exe	34
PID 2212 wrote to memory of 2436	2212	cmd.exe	35
PID 2212 wrote to memory of 2436	2212	cmd.exe	35
PID 2212 wrote to memory of 2436	2212	cmd.exe	35
PID 2212 wrote to memory of 2620	2212	cmd.exe	36
PID 2212 wrote to memory of 2620	2212	cmd.exe	36
PID 2212 wrote to memory of 2620	2212	cmd.exe	36
PID 2212 wrote to memory of 2648	2212	cmd.exe	37
PID 2212 wrote to memory of 2648	2212	cmd.exe	37
PID 2212 wrote to memory of 2648	2212	cmd.exe	37
PID 2212 wrote to memory of 2688	2212	cmd.exe	38
PID 2212 wrote to memory of 2688	2212	cmd.exe	38
PID 2212 wrote to memory of 2688	2212	cmd.exe	38
PID 2212 wrote to memory of 2700	2212	cmd.exe	39
PID 2212 wrote to memory of 2700	2212	cmd.exe	39
PID 2212 wrote to memory of 2700	2212	cmd.exe	39
PID 2212 wrote to memory of 2608	2212	cmd.exe	40
PID 2212 wrote to memory of 2608	2212	cmd.exe	40
PID 2212 wrote to memory of 2608	2212	cmd.exe	40
PID 2608 wrote to memory of 2704	2608	net.exe	41
PID 2608 wrote to memory of 2704	2608	net.exe	41
PID 2608 wrote to memory of 2704	2608	net.exe	41
PID 2212 wrote to memory of 2736	2212	cmd.exe	42
PID 2212 wrote to memory of 2736	2212	cmd.exe	42
PID 2212 wrote to memory of 2736	2212	cmd.exe	42
PID 2736 wrote to memory of 2088	2736	net.exe	43
PID 2736 wrote to memory of 2088	2736	net.exe	43
PID 2736 wrote to memory of 2088	2736	net.exe	43

C:\Windows\system32\cmd.exe
cmd /c "C:\Users\Admin\AppData\Local\Temp\!!BEST TWEAKS\Windows Post-Installation Pack\1 Disable WUs\2 Disable WUs.cmd"
1⤵
- Suspicious use of WriteProcessMemory
PID:2212
- C:\Windows\system32\taskkill.exe
  taskkill /F /FI "IMAGENAME eq SystemSettings.exe"
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:352
- C:\Windows\system32\net.exe
  net stop wuauserv
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2996
- - C:\Windows\system32\net1.exe
    C:\Windows\system32\net1 stop wuauserv
    3⤵
    PID:2584
- C:\Windows\system32\net.exe
  net stop UsoSvc
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2132
- - C:\Windows\system32\net1.exe
    C:\Windows\system32\net1 stop UsoSvc
    3⤵
    PID:3052
- C:\Windows\system32\reg.exe
  reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate" /v "DoNotConnectToWindowsUpdateInternetLocations" /t REG_DWORD /d "1" /f
  2⤵
  PID:2436
- C:\Windows\system32\reg.exe
  reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate" /v "SetDisableUXWUAccess" /t REG_DWORD /d "1" /f
  2⤵
  PID:2620
- C:\Windows\system32\reg.exe
  reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate\AU" /v "NoAutoUpdate" /t REG_DWORD /d "1" /f
  2⤵
  PID:2648
- C:\Windows\system32\reg.exe
  reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate" /v "ExcludeWUDriversInQualityUpdate" /t REG_DWORD /d "1" /f
  2⤵
  PID:2688
- C:\Windows\system32\gpupdate.exe
  gpupdate /force
  2⤵
  PID:2700
- C:\Windows\system32\net.exe
  net start wuauserv
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2608
- - C:\Windows\system32\net1.exe
    C:\Windows\system32\net1 start wuauserv
    3⤵
    PID:2704
- C:\Windows\system32\net.exe
  net start UsoSvc
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2736
- - C:\Windows\system32\net1.exe
    C:\Windows\system32\net1 start UsoSvc
    3⤵
    PID:2088

Windows 7 deprecation

Loading Replay Monitor...

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads