af087e44b9920b0dd59aac8a366a167d5f5457e608b6616450d73956294a9500

Analysis

max time kernel
118s
max time network
119s
platform
windows7_x64
resource
win7-20240708-en
resource tags

arch:x64arch:x86image:win7-20240708-enlocale:en-usos:windows7-x64system
submitted
15/07/2024, 07:24

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

Cleaners/clean4.bat
Size

853KB
MD5

d4c34b33b42ce1a0aa1227fa3a768124
SHA1

796606e45d27fd332c6143f6f09cef3c8a522493
SHA256

d2f5b505cd5a6baaabb9d1f51f6b5800139034db44e220f83b44cd66b3197b38
SHA512

33ffd3944bfe182cfcd9f40bb73af997db37692f6a769953e931af24acbebaa2a698254860fc2095cd507d84a2437907016cc8d1bd3614cf6899f6428ef86ff1
SSDEEP

6144:5tJVSIIgunYMX7GmOgDsMrODuUpW/kBkOR1:X6IIgunYMKmOgDsMrODuUpW/kBkOR1

Score

1^/10

Malware Config

Signatures

Kills process with taskkill 11 IoCs

evasion

pid	Process
2992	taskkill.exe
2364	taskkill.exe
2240	taskkill.exe
2848	taskkill.exe
2348	taskkill.exe
2856	taskkill.exe
2884	taskkill.exe
2652	taskkill.exe
2732	taskkill.exe
2628	taskkill.exe
2320	taskkill.exe

Suspicious use of AdjustPrivilegeToken 11 IoCs

description	pid	Process
Token: SeDebugPrivilege	2240	taskkill.exe
Token: SeDebugPrivilege	2320	taskkill.exe
Token: SeDebugPrivilege	2848	taskkill.exe
Token: SeDebugPrivilege	2992	taskkill.exe
Token: SeDebugPrivilege	2348	taskkill.exe
Token: SeDebugPrivilege	2856	taskkill.exe
Token: SeDebugPrivilege	2884	taskkill.exe
Token: SeDebugPrivilege	2652	taskkill.exe
Token: SeDebugPrivilege	2364	taskkill.exe
Token: SeDebugPrivilege	2732	taskkill.exe
Token: SeDebugPrivilege	2628	taskkill.exe

Suspicious use of WriteProcessMemory 33 IoCs

description	pid	Process	procid_target
PID 2428 wrote to memory of 2240	2428	cmd.exe	32
PID 2428 wrote to memory of 2240	2428	cmd.exe	32
PID 2428 wrote to memory of 2240	2428	cmd.exe	32
PID 2428 wrote to memory of 2320	2428	cmd.exe	34
PID 2428 wrote to memory of 2320	2428	cmd.exe	34
PID 2428 wrote to memory of 2320	2428	cmd.exe	34
PID 2428 wrote to memory of 2848	2428	cmd.exe	35
PID 2428 wrote to memory of 2848	2428	cmd.exe	35
PID 2428 wrote to memory of 2848	2428	cmd.exe	35
PID 2428 wrote to memory of 2992	2428	cmd.exe	36
PID 2428 wrote to memory of 2992	2428	cmd.exe	36
PID 2428 wrote to memory of 2992	2428	cmd.exe	36
PID 2428 wrote to memory of 2348	2428	cmd.exe	37
PID 2428 wrote to memory of 2348	2428	cmd.exe	37
PID 2428 wrote to memory of 2348	2428	cmd.exe	37
PID 2428 wrote to memory of 2856	2428	cmd.exe	38
PID 2428 wrote to memory of 2856	2428	cmd.exe	38
PID 2428 wrote to memory of 2856	2428	cmd.exe	38
PID 2428 wrote to memory of 2884	2428	cmd.exe	39
PID 2428 wrote to memory of 2884	2428	cmd.exe	39
PID 2428 wrote to memory of 2884	2428	cmd.exe	39
PID 2428 wrote to memory of 2652	2428	cmd.exe	40
PID 2428 wrote to memory of 2652	2428	cmd.exe	40
PID 2428 wrote to memory of 2652	2428	cmd.exe	40
PID 2428 wrote to memory of 2364	2428	cmd.exe	41
PID 2428 wrote to memory of 2364	2428	cmd.exe	41
PID 2428 wrote to memory of 2364	2428	cmd.exe	41
PID 2428 wrote to memory of 2732	2428	cmd.exe	42
PID 2428 wrote to memory of 2732	2428	cmd.exe	42
PID 2428 wrote to memory of 2732	2428	cmd.exe	42
PID 2428 wrote to memory of 2628	2428	cmd.exe	43
PID 2428 wrote to memory of 2628	2428	cmd.exe	43
PID 2428 wrote to memory of 2628	2428	cmd.exe	43

C:\Windows\system32\cmd.exe
cmd /c "C:\Users\Admin\AppData\Local\Temp\Cleaners\clean4.bat"
1⤵
- Suspicious use of WriteProcessMemory
PID:2428
- C:\Windows\system32\taskkill.exe
  taskkill /f /im epicgameslauncher.exe
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:2240
- C:\Windows\system32\taskkill.exe
  taskkill /f /im FortniteClient-Win64-Shipping_EAC.exe
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:2320
- C:\Windows\system32\taskkill.exe
  taskkill /f /im FortniteClient-Win64-Shipping.exe
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:2848
- C:\Windows\system32\taskkill.exe
  taskkill /f /im FortniteClient-Win64-Shipping_BE.exe
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:2992
- C:\Windows\system32\taskkill.exe
  taskkill /f /im FortniteLauncher.exe
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:2348
- C:\Windows\system32\taskkill.exe
  taskkill /f /im UnrealCEFSubProcess.exe
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:2856
- C:\Windows\system32\taskkill.exe
  taskkill /f /im CEFProcess.exe
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:2884
- C:\Windows\system32\taskkill.exe
  taskkill /f /im EasyAntiCheat.exe
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:2652
- C:\Windows\system32\taskkill.exe
  taskkill /f /im BEService.exe
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:2364
- C:\Windows\system32\taskkill.exe
  taskkill /f /im BEServices.exe
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:2732
- C:\Windows\system32\taskkill.exe
  taskkill /f /im BattleEye.exe
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:2628

Windows 7 deprecation

Loading Replay Monitor...

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads