ee2ce2eb654a83f51971a834625d0f48efd7640fbd61a23aec5a36e2eb637ace

Analysis

max time kernel
40s
max time network
36s
platform
windows10-2004_x64
resource
win10v2004-20240709-en
resource tags

arch:x64arch:x86image:win10v2004-20240709-enlocale:en-usos:windows10-2004-x64system
submitted
13/07/2024, 10:23

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

yadflegtwerg.bat
Size

69B
MD5

6f5eb5cc03cd8d72295c3ec742e124e8
SHA1

469e5dba60c077530989a544e14333b384578167
SHA256

ee2ce2eb654a83f51971a834625d0f48efd7640fbd61a23aec5a36e2eb637ace
SHA512

77f19441d893d5497410f8174bdde4aeac8f1f5ee5939d6cb7a6a196cc8b6a128e3b5150f5f5eb3af74f2ee5434cd23d528bdd20d91c0e8d16164fde5f2dd454

Score

7^/10

Malware Config

Signatures

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-1750093773-264148664-1320403265-1000\Control Panel\International\Geo\Nation	cmd.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "133653398275941809"	chrome.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	chrome.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
5004	chrome.exe
5004	chrome.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 4 IoCs

pid	Process
5004	chrome.exe
5004	chrome.exe
5004	chrome.exe
5004	chrome.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeShutdownPrivilege	5004	chrome.exe
Token: SeCreatePagefilePrivilege	5004	chrome.exe
Token: SeShutdownPrivilege	5004	chrome.exe
Token: SeCreatePagefilePrivilege	5004	chrome.exe
Token: SeShutdownPrivilege	5004	chrome.exe
Token: SeCreatePagefilePrivilege	5004	chrome.exe
Token: SeShutdownPrivilege	5004	chrome.exe
Token: SeCreatePagefilePrivilege	5004	chrome.exe
Token: SeShutdownPrivilege	5004	chrome.exe
Token: SeCreatePagefilePrivilege	5004	chrome.exe
Token: SeShutdownPrivilege	5004	chrome.exe
Token: SeCreatePagefilePrivilege	5004	chrome.exe
Token: SeShutdownPrivilege	5004	chrome.exe
Token: SeCreatePagefilePrivilege	5004	chrome.exe
Token: SeShutdownPrivilege	5004	chrome.exe
Token: SeCreatePagefilePrivilege	5004	chrome.exe
Token: SeShutdownPrivilege	5004	chrome.exe
Token: SeCreatePagefilePrivilege	5004	chrome.exe
Token: SeShutdownPrivilege	5004	chrome.exe
Token: SeCreatePagefilePrivilege	5004	chrome.exe
Token: SeShutdownPrivilege	5004	chrome.exe
Token: SeCreatePagefilePrivilege	5004	chrome.exe
Token: SeShutdownPrivilege	5004	chrome.exe
Token: SeCreatePagefilePrivilege	5004	chrome.exe
Token: SeShutdownPrivilege	5004	chrome.exe
Token: SeCreatePagefilePrivilege	5004	chrome.exe
Token: SeShutdownPrivilege	5004	chrome.exe
Token: SeCreatePagefilePrivilege	5004	chrome.exe
Token: SeShutdownPrivilege	5004	chrome.exe
Token: SeCreatePagefilePrivilege	5004	chrome.exe
Token: SeShutdownPrivilege	5004	chrome.exe
Token: SeCreatePagefilePrivilege	5004	chrome.exe
Token: SeShutdownPrivilege	5004	chrome.exe
Token: SeCreatePagefilePrivilege	5004	chrome.exe
Token: SeShutdownPrivilege	5004	chrome.exe
Token: SeCreatePagefilePrivilege	5004	chrome.exe
Token: SeShutdownPrivilege	5004	chrome.exe
Token: SeCreatePagefilePrivilege	5004	chrome.exe
Token: SeShutdownPrivilege	5004	chrome.exe
Token: SeCreatePagefilePrivilege	5004	chrome.exe
Token: SeShutdownPrivilege	5004	chrome.exe
Token: SeCreatePagefilePrivilege	5004	chrome.exe
Token: SeShutdownPrivilege	5004	chrome.exe
Token: SeCreatePagefilePrivilege	5004	chrome.exe
Token: SeShutdownPrivilege	5004	chrome.exe
Token: SeCreatePagefilePrivilege	5004	chrome.exe
Token: SeShutdownPrivilege	5004	chrome.exe
Token: SeCreatePagefilePrivilege	5004	chrome.exe
Token: SeShutdownPrivilege	5004	chrome.exe
Token: SeCreatePagefilePrivilege	5004	chrome.exe
Token: SeShutdownPrivilege	5004	chrome.exe
Token: SeCreatePagefilePrivilege	5004	chrome.exe
Token: SeShutdownPrivilege	5004	chrome.exe
Token: SeCreatePagefilePrivilege	5004	chrome.exe
Token: SeShutdownPrivilege	5004	chrome.exe
Token: SeCreatePagefilePrivilege	5004	chrome.exe
Token: SeShutdownPrivilege	5004	chrome.exe
Token: SeCreatePagefilePrivilege	5004	chrome.exe
Token: SeShutdownPrivilege	5004	chrome.exe
Token: SeCreatePagefilePrivilege	5004	chrome.exe
Token: SeShutdownPrivilege	5004	chrome.exe
Token: SeCreatePagefilePrivilege	5004	chrome.exe
Token: SeShutdownPrivilege	5004	chrome.exe
Token: SeCreatePagefilePrivilege	5004	chrome.exe

Suspicious use of FindShellTrayWindow 26 IoCs

pid	Process
5004	chrome.exe
5004	chrome.exe
5004	chrome.exe
5004	chrome.exe
5004	chrome.exe
5004	chrome.exe
5004	chrome.exe
5004	chrome.exe
5004	chrome.exe
5004	chrome.exe
5004	chrome.exe
5004	chrome.exe
5004	chrome.exe
5004	chrome.exe
5004	chrome.exe
5004	chrome.exe
5004	chrome.exe
5004	chrome.exe
5004	chrome.exe
5004	chrome.exe
5004	chrome.exe
5004	chrome.exe
5004	chrome.exe
5004	chrome.exe
5004	chrome.exe
5004	chrome.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
5004	chrome.exe
5004	chrome.exe
5004	chrome.exe
5004	chrome.exe
5004	chrome.exe
5004	chrome.exe
5004	chrome.exe
5004	chrome.exe
5004	chrome.exe
5004	chrome.exe
5004	chrome.exe
5004	chrome.exe
5004	chrome.exe
5004	chrome.exe
5004	chrome.exe
5004	chrome.exe
5004	chrome.exe
5004	chrome.exe
5004	chrome.exe
5004	chrome.exe
5004	chrome.exe
5004	chrome.exe
5004	chrome.exe
5004	chrome.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 632 wrote to memory of 5004	632	cmd.exe	84
PID 632 wrote to memory of 5004	632	cmd.exe	84
PID 5004 wrote to memory of 3100	5004	chrome.exe	87
PID 5004 wrote to memory of 3100	5004	chrome.exe	87
PID 5004 wrote to memory of 828	5004	chrome.exe	89
PID 5004 wrote to memory of 828	5004	chrome.exe	89
PID 5004 wrote to memory of 828	5004	chrome.exe	89
PID 5004 wrote to memory of 828	5004	chrome.exe	89
PID 5004 wrote to memory of 828	5004	chrome.exe	89
PID 5004 wrote to memory of 828	5004	chrome.exe	89
PID 5004 wrote to memory of 828	5004	chrome.exe	89
PID 5004 wrote to memory of 828	5004	chrome.exe	89
PID 5004 wrote to memory of 828	5004	chrome.exe	89
PID 5004 wrote to memory of 828	5004	chrome.exe	89
PID 5004 wrote to memory of 828	5004	chrome.exe	89
PID 5004 wrote to memory of 828	5004	chrome.exe	89
PID 5004 wrote to memory of 828	5004	chrome.exe	89
PID 5004 wrote to memory of 828	5004	chrome.exe	89
PID 5004 wrote to memory of 828	5004	chrome.exe	89
PID 5004 wrote to memory of 828	5004	chrome.exe	89
PID 5004 wrote to memory of 828	5004	chrome.exe	89
PID 5004 wrote to memory of 828	5004	chrome.exe	89
PID 5004 wrote to memory of 828	5004	chrome.exe	89
PID 5004 wrote to memory of 828	5004	chrome.exe	89
PID 5004 wrote to memory of 828	5004	chrome.exe	89
PID 5004 wrote to memory of 828	5004	chrome.exe	89
PID 5004 wrote to memory of 828	5004	chrome.exe	89
PID 5004 wrote to memory of 828	5004	chrome.exe	89
PID 5004 wrote to memory of 828	5004	chrome.exe	89
PID 5004 wrote to memory of 828	5004	chrome.exe	89
PID 5004 wrote to memory of 828	5004	chrome.exe	89
PID 5004 wrote to memory of 828	5004	chrome.exe	89
PID 5004 wrote to memory of 828	5004	chrome.exe	89
PID 5004 wrote to memory of 828	5004	chrome.exe	89
PID 5004 wrote to memory of 1812	5004	chrome.exe	90
PID 5004 wrote to memory of 1812	5004	chrome.exe	90
PID 5004 wrote to memory of 3136	5004	chrome.exe	91
PID 5004 wrote to memory of 3136	5004	chrome.exe	91
PID 5004 wrote to memory of 3136	5004	chrome.exe	91
PID 5004 wrote to memory of 3136	5004	chrome.exe	91
PID 5004 wrote to memory of 3136	5004	chrome.exe	91
PID 5004 wrote to memory of 3136	5004	chrome.exe	91
PID 5004 wrote to memory of 3136	5004	chrome.exe	91
PID 5004 wrote to memory of 3136	5004	chrome.exe	91
PID 5004 wrote to memory of 3136	5004	chrome.exe	91
PID 5004 wrote to memory of 3136	5004	chrome.exe	91
PID 5004 wrote to memory of 3136	5004	chrome.exe	91
PID 5004 wrote to memory of 3136	5004	chrome.exe	91
PID 5004 wrote to memory of 3136	5004	chrome.exe	91
PID 5004 wrote to memory of 3136	5004	chrome.exe	91
PID 5004 wrote to memory of 3136	5004	chrome.exe	91
PID 5004 wrote to memory of 3136	5004	chrome.exe	91
PID 5004 wrote to memory of 3136	5004	chrome.exe	91
PID 5004 wrote to memory of 3136	5004	chrome.exe	91
PID 5004 wrote to memory of 3136	5004	chrome.exe	91
PID 5004 wrote to memory of 3136	5004	chrome.exe	91
PID 5004 wrote to memory of 3136	5004	chrome.exe	91
PID 5004 wrote to memory of 3136	5004	chrome.exe	91
PID 5004 wrote to memory of 3136	5004	chrome.exe	91
PID 5004 wrote to memory of 3136	5004	chrome.exe	91
PID 5004 wrote to memory of 3136	5004	chrome.exe	91
PID 5004 wrote to memory of 3136	5004	chrome.exe	91
PID 5004 wrote to memory of 3136	5004	chrome.exe	91
PID 5004 wrote to memory of 3136	5004	chrome.exe	91

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\yadflegtwerg.bat"
1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
PID:632
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" https://www.worldsoft.blog/TikTokViewBot0eB1z -incognito
  2⤵
  - Enumerates system info in registry
  - Modifies data under HKEY_USERS
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SendNotifyMessage
  - Suspicious use of WriteProcessMemory
  PID:5004
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=123.0.6312.106 --initial-client-data=0xd8,0xfc,0x100,0x84,0x104,0x7ff991a1cc40,0x7ff991a1cc4c,0x7ff991a1cc58
    3⤵
    PID:3100
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-appcompat-clear --gpu-preferences=WAAAAAAAAADgAAAMAAAAAAAAAAAAAAAAAABgAAEAAAA4AAAAAAAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGAAAAAAAAAAYAAAAAAAAAAgAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --field-trial-handle=1892,i,5597487787855232055,1029309279126768590,262144 --variations-seed-version=20240709-050124.519000 --mojo-platform-channel-handle=1888 /prefetch:2
    3⤵
    PID:828
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-appcompat-clear --field-trial-handle=1984,i,5597487787855232055,1029309279126768590,262144 --variations-seed-version=20240709-050124.519000 --mojo-platform-channel-handle=2144 /prefetch:3
    3⤵
    PID:1812
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --no-appcompat-clear --field-trial-handle=2236,i,5597487787855232055,1029309279126768590,262144 --variations-seed-version=20240709-050124.519000 --mojo-platform-channel-handle=2460 /prefetch:8
    3⤵
    PID:3136
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --disable-databases --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --field-trial-handle=3156,i,5597487787855232055,1029309279126768590,262144 --variations-seed-version=20240709-050124.519000 --mojo-platform-channel-handle=3180 /prefetch:1
    3⤵
    PID:1556
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --disable-databases --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --field-trial-handle=3148,i,5597487787855232055,1029309279126768590,262144 --variations-seed-version=20240709-050124.519000 --mojo-platform-channel-handle=3220 /prefetch:1
    3⤵
    PID:2332
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --disable-databases --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --field-trial-handle=3588,i,5597487787855232055,1029309279126768590,262144 --variations-seed-version=20240709-050124.519000 --mojo-platform-channel-handle=3596 /prefetch:1
    3⤵
    PID:1964
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --no-appcompat-clear --field-trial-handle=4956,i,5597487787855232055,1029309279126768590,262144 --variations-seed-version=20240709-050124.519000 --mojo-platform-channel-handle=4968 /prefetch:8
    3⤵
    PID:2416
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --no-appcompat-clear --field-trial-handle=4972,i,5597487787855232055,1029309279126768590,262144 --variations-seed-version=20240709-050124.519000 --mojo-platform-channel-handle=4264 /prefetch:8
    3⤵
    PID:3500
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --disable-databases --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --field-trial-handle=3180,i,5597487787855232055,1029309279126768590,262144 --variations-seed-version=20240709-050124.519000 --mojo-platform-channel-handle=4992 /prefetch:1
    3⤵
    PID:4228

C:\Program Files\Google\Chrome\Application\123.0.6312.106\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\123.0.6312.106\elevation_service.exe"
1⤵
PID:4032

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s NgcSvc
1⤵
PID:1828

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State

Filesize
1KB

MD5
e5fa52e533592be4f93f792921d2ca87

SHA1
66b1108448e8a6058e620789bb5d1a64625f694e

SHA256
06ff42176672a3498ded4485a433b7a073c997d0e9a89cc30d875fd934fe4d6f

SHA512
765355b4697b74c0ddbe5d2d41ccbc8b13f522f49202a1247dd1572aeb9d900f6ac708c2a9db87d551d625d8631d87c492b19d1c15767dc9c2dfac2a18571765

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\SCT Auditing Pending Reports

Filesize
2B

MD5
d751713988987e9331980363e24189ce

SHA1
97d170e1550eee4afc0af065b78cda302a97674c

SHA256
4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945

SHA512
b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
8KB

MD5
7e3494f6660387d56df894d72cb41bc8

SHA1
fb9148b1f87202b992a5384646aabd425da45326

SHA256
420d5b044c35de52e00a534fbf08aedd9de18817dee35a319229d7f33ed02455

SHA512
8ad355f5be7c50b943368e6edf3b42a1a9eca20675d0547dac863d59b4322aa5e9702482fd1c85c74bcc47eb60a9019d43328f2a16d2721be11b1e209f97e46c

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Secure Preferences

Filesize
15KB

MD5
fb7238eaa070f00e899ab29445b2eb44

SHA1
8ebf1025f4552b4e6315d48202c88345a4853b61

SHA256
0811d14b19605005a45e9a8109d3fecf4ca2310b70a8c66409e4910ac89d1e70

SHA512
8638a21e5ef834bc2313f99027b83c28c09963bb8122d3ba9f4dbbda364e440a9e6264c070ce8c6db5cef17e221775794006b79c821489a8c3dbb26bb641cd7b

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State

Filesize
183KB

MD5
9e32b1bccf2d0cd51aad884cfee55b0c

SHA1
577f163133b701fa59350895c4af9e5d6587ea71

SHA256
7b571223e318badffdda42640f349979f0009cf1372b5e1878e0a7033a004804

SHA512
fc8dd486901e5f1fa50b5917b8d14cf7fbb6a6602d6d1a801f00d24aedcb133b7fee466ad807d233b98b40a960e5eb5a95a9f70a3e11bd4e29b6c3879499501b

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State

Filesize
183KB

MD5
ee39484530c80247478d051e4ef0a15d

SHA1
1cb318cacbf4834d4049d685dabcd0ff6fdc371d

SHA256
46818f49935c21e143c47de4c53ffd7a7b7ddf4ffd079104465b9ac7f2af6533

SHA512
bf05d8a5cfef2e9a3c2826788058af7f0ed592b4e2d44954cf34b9181c8c45b21bb8c195cb3df7382bdeb2799657f03fa9427a062f2175eb8f342d978db82980

Download Submit