4ee85019c1ae4d1abf8ea1908f635339d0a4af88ba185dc30e1104e68c7c902e

Resubmissions

10/07/2024, 02:30

240710-czl2gstcke 10

20/06/2024, 12:39

20/06/2024, 12:36

20/06/2024, 12:35

20/06/2024, 12:33

Analysis

max time kernel
118s
max time network
119s
platform
windows7_x64
resource
win7-20240708-en
resource tags

arch:x64arch:x86image:win7-20240708-enlocale:en-usos:windows7-x64system
submitted
10/07/2024, 02:30

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

spoofers/serial_checker.bat
Size

437B
MD5

0c088b6adc55c20fc375badef6f7e9a7
SHA1

37c865ebfe537b94534844281e9086462f3e2462
SHA256

51f783d41ad3a807344eb9550d65cb4638793aac71f4eb4a1a11414b24e339e1
SHA512

7f82c647413f997a537148ab7d1e8a5cff9fef18561783f329485dbb67ab76a2a8defa0a7304feb7e1e79645b50b8cb2d4a069ff3ec668542fdefb1adbde6f5d

Score

1^/10

Malware Config

Signatures

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeIncreaseQuotaPrivilege	268	WMIC.exe
Token: SeSecurityPrivilege	268	WMIC.exe
Token: SeTakeOwnershipPrivilege	268	WMIC.exe
Token: SeLoadDriverPrivilege	268	WMIC.exe
Token: SeSystemProfilePrivilege	268	WMIC.exe
Token: SeSystemtimePrivilege	268	WMIC.exe
Token: SeProfSingleProcessPrivilege	268	WMIC.exe
Token: SeIncBasePriorityPrivilege	268	WMIC.exe
Token: SeCreatePagefilePrivilege	268	WMIC.exe
Token: SeBackupPrivilege	268	WMIC.exe
Token: SeRestorePrivilege	268	WMIC.exe
Token: SeShutdownPrivilege	268	WMIC.exe
Token: SeDebugPrivilege	268	WMIC.exe
Token: SeSystemEnvironmentPrivilege	268	WMIC.exe
Token: SeRemoteShutdownPrivilege	268	WMIC.exe
Token: SeUndockPrivilege	268	WMIC.exe
Token: SeManageVolumePrivilege	268	WMIC.exe
Token: 33	268	WMIC.exe
Token: 34	268	WMIC.exe
Token: 35	268	WMIC.exe
Token: SeIncreaseQuotaPrivilege	268	WMIC.exe
Token: SeSecurityPrivilege	268	WMIC.exe
Token: SeTakeOwnershipPrivilege	268	WMIC.exe
Token: SeLoadDriverPrivilege	268	WMIC.exe
Token: SeSystemProfilePrivilege	268	WMIC.exe
Token: SeSystemtimePrivilege	268	WMIC.exe
Token: SeProfSingleProcessPrivilege	268	WMIC.exe
Token: SeIncBasePriorityPrivilege	268	WMIC.exe
Token: SeCreatePagefilePrivilege	268	WMIC.exe
Token: SeBackupPrivilege	268	WMIC.exe
Token: SeRestorePrivilege	268	WMIC.exe
Token: SeShutdownPrivilege	268	WMIC.exe
Token: SeDebugPrivilege	268	WMIC.exe
Token: SeSystemEnvironmentPrivilege	268	WMIC.exe
Token: SeRemoteShutdownPrivilege	268	WMIC.exe
Token: SeUndockPrivilege	268	WMIC.exe
Token: SeManageVolumePrivilege	268	WMIC.exe
Token: 33	268	WMIC.exe
Token: 34	268	WMIC.exe
Token: 35	268	WMIC.exe
Token: SeIncreaseQuotaPrivilege	2648	WMIC.exe
Token: SeSecurityPrivilege	2648	WMIC.exe
Token: SeTakeOwnershipPrivilege	2648	WMIC.exe
Token: SeLoadDriverPrivilege	2648	WMIC.exe
Token: SeSystemProfilePrivilege	2648	WMIC.exe
Token: SeSystemtimePrivilege	2648	WMIC.exe
Token: SeProfSingleProcessPrivilege	2648	WMIC.exe
Token: SeIncBasePriorityPrivilege	2648	WMIC.exe
Token: SeCreatePagefilePrivilege	2648	WMIC.exe
Token: SeBackupPrivilege	2648	WMIC.exe
Token: SeRestorePrivilege	2648	WMIC.exe
Token: SeShutdownPrivilege	2648	WMIC.exe
Token: SeDebugPrivilege	2648	WMIC.exe
Token: SeSystemEnvironmentPrivilege	2648	WMIC.exe
Token: SeRemoteShutdownPrivilege	2648	WMIC.exe
Token: SeUndockPrivilege	2648	WMIC.exe
Token: SeManageVolumePrivilege	2648	WMIC.exe
Token: 33	2648	WMIC.exe
Token: 34	2648	WMIC.exe
Token: 35	2648	WMIC.exe
Token: SeIncreaseQuotaPrivilege	2648	WMIC.exe
Token: SeSecurityPrivilege	2648	WMIC.exe
Token: SeTakeOwnershipPrivilege	2648	WMIC.exe
Token: SeLoadDriverPrivilege	2648	WMIC.exe

Suspicious use of WriteProcessMemory 18 IoCs

description	pid	Process	procid_target
PID 2616 wrote to memory of 268	2616	cmd.exe	32
PID 2616 wrote to memory of 268	2616	cmd.exe	32
PID 2616 wrote to memory of 268	2616	cmd.exe	32
PID 2616 wrote to memory of 2648	2616	cmd.exe	34
PID 2616 wrote to memory of 2648	2616	cmd.exe	34
PID 2616 wrote to memory of 2648	2616	cmd.exe	34
PID 2616 wrote to memory of 2808	2616	cmd.exe	35
PID 2616 wrote to memory of 2808	2616	cmd.exe	35
PID 2616 wrote to memory of 2808	2616	cmd.exe	35
PID 2616 wrote to memory of 2396	2616	cmd.exe	36
PID 2616 wrote to memory of 2396	2616	cmd.exe	36
PID 2616 wrote to memory of 2396	2616	cmd.exe	36
PID 2616 wrote to memory of 2688	2616	cmd.exe	37
PID 2616 wrote to memory of 2688	2616	cmd.exe	37
PID 2616 wrote to memory of 2688	2616	cmd.exe	37
PID 2616 wrote to memory of 2724	2616	cmd.exe	38
PID 2616 wrote to memory of 2724	2616	cmd.exe	38
PID 2616 wrote to memory of 2724	2616	cmd.exe	38

C:\Windows\system32\cmd.exe
cmd /c "C:\Users\Admin\AppData\Local\Temp\spoofers\serial_checker.bat"
1⤵
- Suspicious use of WriteProcessMemory
PID:2616
- C:\Windows\System32\Wbem\WMIC.exe
  wmic diskdrive get model, serialnumber
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  PID:268
- C:\Windows\System32\Wbem\WMIC.exe
  wmic cpu get serialnumber
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  PID:2648
- C:\Windows\System32\Wbem\WMIC.exe
  wmic bios get serialnumber
  2⤵
  PID:2808
- C:\Windows\System32\Wbem\WMIC.exe
  wmic baseboard get serialnumber
  2⤵
  PID:2396
- C:\Windows\System32\Wbem\WMIC.exe
  wmic path win32_computersystemproduct get uuid
  2⤵
  PID:2688
- C:\Windows\system32\getmac.exe
  getmac
  2⤵
  PID:2724

Resubmissions

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads