919bce39654fbf7c27b8ad159363fe0ec3f38690222cb9fa4374815a5dea7191

Analysis

max time kernel
13s
max time network
17s
platform
windows7_x64
resource
win7-20240708-en
resource tags

arch:x64arch:x86image:win7-20240708-enlocale:en-usos:windows7-x64system
submitted
12/07/2024, 14:21

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
Serial Checker.bat
Size 539B
Sample240712-rn77xaxcpm
SHA256 036d1d1de2b2c68620345f56707219c793840fed9cc73bd7815dd310581b0d0e
MD5 c618c11d31191de753c2bb7e22840289
SHA1 2a2a3cc70a64d90f56df7041e16724ad069b4dcf
SHA512 d2f158c2ca0b30892df4f72d4f7fc96c3e57e8a88c3831e6898af75de8bfd24515713afae18f457b95eebec8ad2be7a5b94553469a16dd36f56505adaf78299c
MD5 SHA1 SHA512

Score

1^/10

Malware Config

Signatures

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeIncreaseQuotaPrivilege	2492	WMIC.exe
Token: SeSecurityPrivilege	2492	WMIC.exe
Token: SeTakeOwnershipPrivilege	2492	WMIC.exe
Token: SeLoadDriverPrivilege	2492	WMIC.exe
Token: SeSystemProfilePrivilege	2492	WMIC.exe
Token: SeSystemtimePrivilege	2492	WMIC.exe
Token: SeProfSingleProcessPrivilege	2492	WMIC.exe
Token: SeIncBasePriorityPrivilege	2492	WMIC.exe
Token: SeCreatePagefilePrivilege	2492	WMIC.exe
Token: SeBackupPrivilege	2492	WMIC.exe
Token: SeRestorePrivilege	2492	WMIC.exe
Token: SeShutdownPrivilege	2492	WMIC.exe
Token: SeDebugPrivilege	2492	WMIC.exe
Token: SeSystemEnvironmentPrivilege	2492	WMIC.exe
Token: SeRemoteShutdownPrivilege	2492	WMIC.exe
Token: SeUndockPrivilege	2492	WMIC.exe
Token: SeManageVolumePrivilege	2492	WMIC.exe
Token: 33	2492	WMIC.exe
Token: 34	2492	WMIC.exe
Token: 35	2492	WMIC.exe
Token: SeIncreaseQuotaPrivilege	2492	WMIC.exe
Token: SeSecurityPrivilege	2492	WMIC.exe
Token: SeTakeOwnershipPrivilege	2492	WMIC.exe
Token: SeLoadDriverPrivilege	2492	WMIC.exe
Token: SeSystemProfilePrivilege	2492	WMIC.exe
Token: SeSystemtimePrivilege	2492	WMIC.exe
Token: SeProfSingleProcessPrivilege	2492	WMIC.exe
Token: SeIncBasePriorityPrivilege	2492	WMIC.exe
Token: SeCreatePagefilePrivilege	2492	WMIC.exe
Token: SeBackupPrivilege	2492	WMIC.exe
Token: SeRestorePrivilege	2492	WMIC.exe
Token: SeShutdownPrivilege	2492	WMIC.exe
Token: SeDebugPrivilege	2492	WMIC.exe
Token: SeSystemEnvironmentPrivilege	2492	WMIC.exe
Token: SeRemoteShutdownPrivilege	2492	WMIC.exe
Token: SeUndockPrivilege	2492	WMIC.exe
Token: SeManageVolumePrivilege	2492	WMIC.exe
Token: 33	2492	WMIC.exe
Token: 34	2492	WMIC.exe
Token: 35	2492	WMIC.exe
Token: SeIncreaseQuotaPrivilege	276	WMIC.exe
Token: SeSecurityPrivilege	276	WMIC.exe
Token: SeTakeOwnershipPrivilege	276	WMIC.exe
Token: SeLoadDriverPrivilege	276	WMIC.exe
Token: SeSystemProfilePrivilege	276	WMIC.exe
Token: SeSystemtimePrivilege	276	WMIC.exe
Token: SeProfSingleProcessPrivilege	276	WMIC.exe
Token: SeIncBasePriorityPrivilege	276	WMIC.exe
Token: SeCreatePagefilePrivilege	276	WMIC.exe
Token: SeBackupPrivilege	276	WMIC.exe
Token: SeRestorePrivilege	276	WMIC.exe
Token: SeShutdownPrivilege	276	WMIC.exe
Token: SeDebugPrivilege	276	WMIC.exe
Token: SeSystemEnvironmentPrivilege	276	WMIC.exe
Token: SeRemoteShutdownPrivilege	276	WMIC.exe
Token: SeUndockPrivilege	276	WMIC.exe
Token: SeManageVolumePrivilege	276	WMIC.exe
Token: 33	276	WMIC.exe
Token: 34	276	WMIC.exe
Token: 35	276	WMIC.exe
Token: SeIncreaseQuotaPrivilege	276	WMIC.exe
Token: SeSecurityPrivilege	276	WMIC.exe
Token: SeTakeOwnershipPrivilege	276	WMIC.exe
Token: SeLoadDriverPrivilege	276	WMIC.exe

Suspicious use of WriteProcessMemory 30 IoCs

description	pid	Process	procid_target
PID 1092 wrote to memory of 2076	1092	cmd.exe	30
PID 1092 wrote to memory of 2076	1092	cmd.exe	30
PID 1092 wrote to memory of 2076	1092	cmd.exe	30
PID 1092 wrote to memory of 2492	1092	cmd.exe	31
PID 1092 wrote to memory of 2492	1092	cmd.exe	31
PID 1092 wrote to memory of 2492	1092	cmd.exe	31
PID 1092 wrote to memory of 276	1092	cmd.exe	33
PID 1092 wrote to memory of 276	1092	cmd.exe	33
PID 1092 wrote to memory of 276	1092	cmd.exe	33
PID 1092 wrote to memory of 2420	1092	cmd.exe	34
PID 1092 wrote to memory of 2420	1092	cmd.exe	34
PID 1092 wrote to memory of 2420	1092	cmd.exe	34
PID 1092 wrote to memory of 2760	1092	cmd.exe	35
PID 1092 wrote to memory of 2760	1092	cmd.exe	35
PID 1092 wrote to memory of 2760	1092	cmd.exe	35
PID 1092 wrote to memory of 2940	1092	cmd.exe	36
PID 1092 wrote to memory of 2940	1092	cmd.exe	36
PID 1092 wrote to memory of 2940	1092	cmd.exe	36
PID 1092 wrote to memory of 2712	1092	cmd.exe	37
PID 1092 wrote to memory of 2712	1092	cmd.exe	37
PID 1092 wrote to memory of 2712	1092	cmd.exe	37
PID 1092 wrote to memory of 2824	1092	cmd.exe	38
PID 1092 wrote to memory of 2824	1092	cmd.exe	38
PID 1092 wrote to memory of 2824	1092	cmd.exe	38
PID 1092 wrote to memory of 2904	1092	cmd.exe	39
PID 1092 wrote to memory of 2904	1092	cmd.exe	39
PID 1092 wrote to memory of 2904	1092	cmd.exe	39
PID 1092 wrote to memory of 2828	1092	cmd.exe	40
PID 1092 wrote to memory of 2828	1092	cmd.exe	40
PID 1092 wrote to memory of 2828	1092	cmd.exe	40

C:\Windows\system32\cmd.exe
cmd /c "C:\Users\Admin\AppData\Local\Temp\Serial Checker.bat"
1⤵
- Suspicious use of WriteProcessMemory
PID:1092
- C:\Windows\system32\mode.com
  mode con: cols=90 lines=45
  2⤵
  PID:2076
- C:\Windows\System32\Wbem\WMIC.exe
  wmic bios get serialnumber
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  PID:2492
- C:\Windows\System32\Wbem\WMIC.exe
  wmic csproduct get uuid
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  PID:276
- C:\Windows\System32\Wbem\WMIC.exe
  wmic cpu get serialnumber
  2⤵
  PID:2420
- C:\Windows\System32\Wbem\WMIC.exe
  wmic cpu get processorid
  2⤵
  PID:2760
- C:\Windows\System32\Wbem\WMIC.exe
  wmic diskdrive get serialnumber
  2⤵
  PID:2940
- C:\Windows\System32\Wbem\WMIC.exe
  wmic baseboard get serialnumber
  2⤵
  PID:2712
- C:\Windows\System32\Wbem\WMIC.exe
  wmic memorychip get serialnumber
  2⤵
  PID:2824
- C:\Windows\System32\Wbem\WMIC.exe
  wmic path Win32_NetworkAdapter where "PNPDeviceID like '%PCI%' AND NetConnectionStatus=2 AND AdapterTypeID='0'" get MacAddress
  2⤵
  PID:2904
- C:\Windows\System32\Wbem\WMIC.exe
  wmic PATH Win32_VideoController GET Description,PNPDeviceID
  2⤵
  PID:2828

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads