919bce39654fbf7c27b8ad159363fe0ec3f38690222cb9fa4374815a5dea7191

Analysis

max time kernel
141s
max time network
154s
platform
windows10-2004_x64
resource
win10v2004-20240709-en
resource tags

arch:x64arch:x86image:win10v2004-20240709-enlocale:en-usos:windows10-2004-x64system
submitted
12/07/2024, 14:21

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
Serial Checker.bat
Size 539B
Sample240712-rn77xaxcpm
SHA256 036d1d1de2b2c68620345f56707219c793840fed9cc73bd7815dd310581b0d0e
MD5 c618c11d31191de753c2bb7e22840289
SHA1 2a2a3cc70a64d90f56df7041e16724ad069b4dcf
SHA512 d2f158c2ca0b30892df4f72d4f7fc96c3e57e8a88c3831e6898af75de8bfd24515713afae18f457b95eebec8ad2be7a5b94553469a16dd36f56505adaf78299c
MD5 SHA1 SHA512

Score

1^/10

Malware Config

Signatures

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeIncreaseQuotaPrivilege	2128	WMIC.exe
Token: SeSecurityPrivilege	2128	WMIC.exe
Token: SeTakeOwnershipPrivilege	2128	WMIC.exe
Token: SeLoadDriverPrivilege	2128	WMIC.exe
Token: SeSystemProfilePrivilege	2128	WMIC.exe
Token: SeSystemtimePrivilege	2128	WMIC.exe
Token: SeProfSingleProcessPrivilege	2128	WMIC.exe
Token: SeIncBasePriorityPrivilege	2128	WMIC.exe
Token: SeCreatePagefilePrivilege	2128	WMIC.exe
Token: SeBackupPrivilege	2128	WMIC.exe
Token: SeRestorePrivilege	2128	WMIC.exe
Token: SeShutdownPrivilege	2128	WMIC.exe
Token: SeDebugPrivilege	2128	WMIC.exe
Token: SeSystemEnvironmentPrivilege	2128	WMIC.exe
Token: SeRemoteShutdownPrivilege	2128	WMIC.exe
Token: SeUndockPrivilege	2128	WMIC.exe
Token: SeManageVolumePrivilege	2128	WMIC.exe
Token: 33	2128	WMIC.exe
Token: 34	2128	WMIC.exe
Token: 35	2128	WMIC.exe
Token: 36	2128	WMIC.exe
Token: SeIncreaseQuotaPrivilege	2128	WMIC.exe
Token: SeSecurityPrivilege	2128	WMIC.exe
Token: SeTakeOwnershipPrivilege	2128	WMIC.exe
Token: SeLoadDriverPrivilege	2128	WMIC.exe
Token: SeSystemProfilePrivilege	2128	WMIC.exe
Token: SeSystemtimePrivilege	2128	WMIC.exe
Token: SeProfSingleProcessPrivilege	2128	WMIC.exe
Token: SeIncBasePriorityPrivilege	2128	WMIC.exe
Token: SeCreatePagefilePrivilege	2128	WMIC.exe
Token: SeBackupPrivilege	2128	WMIC.exe
Token: SeRestorePrivilege	2128	WMIC.exe
Token: SeShutdownPrivilege	2128	WMIC.exe
Token: SeDebugPrivilege	2128	WMIC.exe
Token: SeSystemEnvironmentPrivilege	2128	WMIC.exe
Token: SeRemoteShutdownPrivilege	2128	WMIC.exe
Token: SeUndockPrivilege	2128	WMIC.exe
Token: SeManageVolumePrivilege	2128	WMIC.exe
Token: 33	2128	WMIC.exe
Token: 34	2128	WMIC.exe
Token: 35	2128	WMIC.exe
Token: 36	2128	WMIC.exe
Token: SeIncreaseQuotaPrivilege	212	WMIC.exe
Token: SeSecurityPrivilege	212	WMIC.exe
Token: SeTakeOwnershipPrivilege	212	WMIC.exe
Token: SeLoadDriverPrivilege	212	WMIC.exe
Token: SeSystemProfilePrivilege	212	WMIC.exe
Token: SeSystemtimePrivilege	212	WMIC.exe
Token: SeProfSingleProcessPrivilege	212	WMIC.exe
Token: SeIncBasePriorityPrivilege	212	WMIC.exe
Token: SeCreatePagefilePrivilege	212	WMIC.exe
Token: SeBackupPrivilege	212	WMIC.exe
Token: SeRestorePrivilege	212	WMIC.exe
Token: SeShutdownPrivilege	212	WMIC.exe
Token: SeDebugPrivilege	212	WMIC.exe
Token: SeSystemEnvironmentPrivilege	212	WMIC.exe
Token: SeRemoteShutdownPrivilege	212	WMIC.exe
Token: SeUndockPrivilege	212	WMIC.exe
Token: SeManageVolumePrivilege	212	WMIC.exe
Token: 33	212	WMIC.exe
Token: 34	212	WMIC.exe
Token: 35	212	WMIC.exe
Token: 36	212	WMIC.exe
Token: SeIncreaseQuotaPrivilege	212	WMIC.exe

Suspicious use of WriteProcessMemory 20 IoCs

description	pid	Process	procid_target
PID 3728 wrote to memory of 3384	3728	cmd.exe	84
PID 3728 wrote to memory of 3384	3728	cmd.exe	84
PID 3728 wrote to memory of 2128	3728	cmd.exe	85
PID 3728 wrote to memory of 2128	3728	cmd.exe	85
PID 3728 wrote to memory of 212	3728	cmd.exe	87
PID 3728 wrote to memory of 212	3728	cmd.exe	87
PID 3728 wrote to memory of 1212	3728	cmd.exe	88
PID 3728 wrote to memory of 1212	3728	cmd.exe	88
PID 3728 wrote to memory of 220	3728	cmd.exe	89
PID 3728 wrote to memory of 220	3728	cmd.exe	89
PID 3728 wrote to memory of 3096	3728	cmd.exe	90
PID 3728 wrote to memory of 3096	3728	cmd.exe	90
PID 3728 wrote to memory of 3732	3728	cmd.exe	91
PID 3728 wrote to memory of 3732	3728	cmd.exe	91
PID 3728 wrote to memory of 2064	3728	cmd.exe	92
PID 3728 wrote to memory of 2064	3728	cmd.exe	92
PID 3728 wrote to memory of 2752	3728	cmd.exe	93
PID 3728 wrote to memory of 2752	3728	cmd.exe	93
PID 3728 wrote to memory of 2468	3728	cmd.exe	94
PID 3728 wrote to memory of 2468	3728	cmd.exe	94

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\Serial Checker.bat"
1⤵
- Suspicious use of WriteProcessMemory
PID:3728
- C:\Windows\system32\mode.com
  mode con: cols=90 lines=45
  2⤵
  PID:3384
- C:\Windows\System32\Wbem\WMIC.exe
  wmic bios get serialnumber
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  PID:2128
- C:\Windows\System32\Wbem\WMIC.exe
  wmic csproduct get uuid
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  PID:212
- C:\Windows\System32\Wbem\WMIC.exe
  wmic cpu get serialnumber
  2⤵
  PID:1212
- C:\Windows\System32\Wbem\WMIC.exe
  wmic cpu get processorid
  2⤵
  PID:220
- C:\Windows\System32\Wbem\WMIC.exe
  wmic diskdrive get serialnumber
  2⤵
  PID:3096
- C:\Windows\System32\Wbem\WMIC.exe
  wmic baseboard get serialnumber
  2⤵
  PID:3732
- C:\Windows\System32\Wbem\WMIC.exe
  wmic memorychip get serialnumber
  2⤵
  PID:2064
- C:\Windows\System32\Wbem\WMIC.exe
  wmic path Win32_NetworkAdapter where "PNPDeviceID like '%PCI%' AND NetConnectionStatus=2 AND AdapterTypeID='0'" get MacAddress
  2⤵
  PID:2752
- C:\Windows\System32\Wbem\WMIC.exe
  wmic PATH Win32_VideoController GET Description,PNPDeviceID
  2⤵
  PID:2468

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads