600989d3a37ca947b061723663e034cc8180bc17379093875e9af76c804ea205

Analysis

max time kernel
6s
max time network
8s
platform
windows10-2004_x64
resource
win10v2004-20240709-en
resource tags

arch:x64arch:x86image:win10v2004-20240709-enlocale:en-usos:windows10-2004-x64system
submitted
15/07/2024, 20:14

Sharing

Copy URL

Twitter E-mail

Reason

Machine shutdown

Report Analysis Logs

General

Target

اخترقV2.bat
Size

305B
MD5

e00b5b8cee3793e1f8ebc839d1c78ded
SHA1

e8d66c0a6f37dd91267f8c62194e3808a89c69b7
SHA256

600989d3a37ca947b061723663e034cc8180bc17379093875e9af76c804ea205
SHA512

1edc1984e4562347a704b1230c384c50cbe5668ade164868004d6030dce84f49cffa09dc04a33806da4ed7778e34e3e89a191aaa7f83002fbec7debb3c7914cf

Score

1^/10

Malware Config

Signatures

Modifies data under HKEY_USERS 15 IoCs

description	ioc	Process
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\Accent\StartColorMenu = "4288567808"	LogonUI.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Themes\History	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Themes\History\AutoColor = "0"	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationColor = "3288365271"	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationAfterglow = "3288365271"	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationAfterglowBalance = "10"	LogonUI.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\AccentColor = "4292311040"	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\EnableWindowColorization = "218"	LogonUI.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\Accent\AccentPalette = a6d8ff0076b9ed00429ce3000078d700005a9e000042750000264200f7630c00	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\Accent\AccentColorMenu = "4292311040"	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationBlurBalance = "1"	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationGlassAttribute = "1"	LogonUI.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\Accent	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationColorBalance = "89"	LogonUI.exe

Runs ping.exe 1 TTPs 1 IoCs

Remote System Discovery

T1018

pid	Process
1832	PING.EXE

Suspicious use of AdjustPrivilegeToken 60 IoCs

description	pid	Process
Token: SeRestorePrivilege	2716	7z.exe
Token: 35	2716	7z.exe
Token: SeRestorePrivilege	1572	7z.exe
Token: 35	1572	7z.exe
Token: SeRestorePrivilege	556	7z.exe
Token: 35	556	7z.exe
Token: SeRestorePrivilege	1428	7z.exe
Token: 35	1428	7z.exe
Token: SeRestorePrivilege	1012	7z.exe
Token: 35	1012	7z.exe
Token: SeRestorePrivilege	2968	7z.exe
Token: 35	2968	7z.exe
Token: SeRestorePrivilege	1168	7z.exe
Token: 35	1168	7z.exe
Token: SeRestorePrivilege	1712	7z.exe
Token: 35	1712	7z.exe
Token: SeRestorePrivilege	1700	7z.exe
Token: 35	1700	7z.exe
Token: SeRestorePrivilege	4724	7z.exe
Token: 35	4724	7z.exe
Token: SeRestorePrivilege	2296	7z.exe
Token: 35	2296	7z.exe
Token: SeRestorePrivilege	456	7z.exe
Token: 35	456	7z.exe
Token: SeRestorePrivilege	4680	7z.exe
Token: 35	4680	7z.exe
Token: SeRestorePrivilege	3864	7z.exe
Token: 35	3864	7z.exe
Token: SeRestorePrivilege	2472	7z.exe
Token: 35	2472	7z.exe
Token: SeRestorePrivilege	3244	7z.exe
Token: 35	3244	7z.exe
Token: SeRestorePrivilege	2964	7z.exe
Token: 35	2964	7z.exe
Token: SeRestorePrivilege	2036	7z.exe
Token: 35	2036	7z.exe
Token: SeRestorePrivilege	3292	7z.exe
Token: 35	3292	7z.exe
Token: SeRestorePrivilege	1068	7z.exe
Token: 35	1068	7z.exe
Token: SeRestorePrivilege	4352	7z.exe
Token: 35	4352	7z.exe
Token: SeRestorePrivilege	4076	7z.exe
Token: 35	4076	7z.exe
Token: SeRestorePrivilege	228	7z.exe
Token: 35	228	7z.exe
Token: SeRestorePrivilege	2168	7z.exe
Token: 35	2168	7z.exe
Token: SeRestorePrivilege	3288	7z.exe
Token: 35	3288	7z.exe
Token: SeRestorePrivilege	5004	7z.exe
Token: 35	5004	7z.exe
Token: SeRestorePrivilege	1980	7z.exe
Token: 35	1980	7z.exe
Token: SeRestorePrivilege	4516	7z.exe
Token: 35	4516	7z.exe
Token: SeRestorePrivilege	468	7z.exe
Token: 35	468	7z.exe
Token: SeShutdownPrivilege	4192	shutdown.exe
Token: SeRemoteShutdownPrivilege	4192	shutdown.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
4068	LogonUI.exe

Suspicious use of WriteProcessMemory 62 IoCs

description	pid	Process	procid_target
PID 2624 wrote to memory of 2716	2624	cmd.exe	84
PID 2624 wrote to memory of 2716	2624	cmd.exe	84
PID 2624 wrote to memory of 1572	2624	cmd.exe	85
PID 2624 wrote to memory of 1572	2624	cmd.exe	85
PID 2624 wrote to memory of 556	2624	cmd.exe	86
PID 2624 wrote to memory of 556	2624	cmd.exe	86
PID 2624 wrote to memory of 1428	2624	cmd.exe	87
PID 2624 wrote to memory of 1428	2624	cmd.exe	87
PID 2624 wrote to memory of 1012	2624	cmd.exe	88
PID 2624 wrote to memory of 1012	2624	cmd.exe	88
PID 2624 wrote to memory of 2968	2624	cmd.exe	89
PID 2624 wrote to memory of 2968	2624	cmd.exe	89
PID 2624 wrote to memory of 1168	2624	cmd.exe	90
PID 2624 wrote to memory of 1168	2624	cmd.exe	90
PID 2624 wrote to memory of 1712	2624	cmd.exe	92
PID 2624 wrote to memory of 1712	2624	cmd.exe	92
PID 2624 wrote to memory of 1700	2624	cmd.exe	93
PID 2624 wrote to memory of 1700	2624	cmd.exe	93
PID 2624 wrote to memory of 4724	2624	cmd.exe	94
PID 2624 wrote to memory of 4724	2624	cmd.exe	94
PID 2624 wrote to memory of 2296	2624	cmd.exe	95
PID 2624 wrote to memory of 2296	2624	cmd.exe	95
PID 2624 wrote to memory of 456	2624	cmd.exe	96
PID 2624 wrote to memory of 456	2624	cmd.exe	96
PID 2624 wrote to memory of 4680	2624	cmd.exe	97
PID 2624 wrote to memory of 4680	2624	cmd.exe	97
PID 2624 wrote to memory of 3864	2624	cmd.exe	98
PID 2624 wrote to memory of 3864	2624	cmd.exe	98
PID 2624 wrote to memory of 2472	2624	cmd.exe	100
PID 2624 wrote to memory of 2472	2624	cmd.exe	100
PID 2624 wrote to memory of 3244	2624	cmd.exe	101
PID 2624 wrote to memory of 3244	2624	cmd.exe	101
PID 2624 wrote to memory of 2964	2624	cmd.exe	102
PID 2624 wrote to memory of 2964	2624	cmd.exe	102
PID 2624 wrote to memory of 2036	2624	cmd.exe	103
PID 2624 wrote to memory of 2036	2624	cmd.exe	103
PID 2624 wrote to memory of 3292	2624	cmd.exe	104
PID 2624 wrote to memory of 3292	2624	cmd.exe	104
PID 2624 wrote to memory of 1068	2624	cmd.exe	105
PID 2624 wrote to memory of 1068	2624	cmd.exe	105
PID 2624 wrote to memory of 4352	2624	cmd.exe	106
PID 2624 wrote to memory of 4352	2624	cmd.exe	106
PID 2624 wrote to memory of 4076	2624	cmd.exe	108
PID 2624 wrote to memory of 4076	2624	cmd.exe	108
PID 2624 wrote to memory of 228	2624	cmd.exe	109
PID 2624 wrote to memory of 228	2624	cmd.exe	109
PID 2624 wrote to memory of 2168	2624	cmd.exe	110
PID 2624 wrote to memory of 2168	2624	cmd.exe	110
PID 2624 wrote to memory of 3288	2624	cmd.exe	111
PID 2624 wrote to memory of 3288	2624	cmd.exe	111
PID 2624 wrote to memory of 5004	2624	cmd.exe	112
PID 2624 wrote to memory of 5004	2624	cmd.exe	112
PID 2624 wrote to memory of 1980	2624	cmd.exe	113
PID 2624 wrote to memory of 1980	2624	cmd.exe	113
PID 2624 wrote to memory of 4516	2624	cmd.exe	114
PID 2624 wrote to memory of 4516	2624	cmd.exe	114
PID 2624 wrote to memory of 468	2624	cmd.exe	115
PID 2624 wrote to memory of 468	2624	cmd.exe	115
PID 2624 wrote to memory of 1832	2624	cmd.exe	116
PID 2624 wrote to memory of 1832	2624	cmd.exe	116
PID 2624 wrote to memory of 4192	2624	cmd.exe	118
PID 2624 wrote to memory of 4192	2624	cmd.exe	118

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\اخترقV2.bat"
1⤵
- Suspicious use of WriteProcessMemory
PID:2624
- C:\Program Files\7-Zip\7z.exe
  "C:\Program Files\7-Zip\7z.exe" to -tzip "AddApprove.ps1" "AddApprove.ps1"
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  PID:2716
- C:\Program Files\7-Zip\7z.exe
  "C:\Program Files\7-Zip\7z.exe" to -tzip "ApproveGet.ps1" "ApproveGet.docx"
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  PID:1572
- C:\Program Files\7-Zip\7z.exe
  "C:\Program Files\7-Zip\7z.exe" to -tzip "BlockPublish.ps1" "BlockPublish.zip"
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  PID:556
- C:\Program Files\7-Zip\7z.exe
  "C:\Program Files\7-Zip\7z.exe" to -tzip "CheckpointAssert.ps1" "CheckpointAssert.midi"
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  PID:1428
- C:\Program Files\7-Zip\7z.exe
  "C:\Program Files\7-Zip\7z.exe" to -tzip "CompareEdit.ps1" "CompareEdit.au"
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  PID:1012
- C:\Program Files\7-Zip\7z.exe
  "C:\Program Files\7-Zip\7z.exe" to -tzip "CompressMerge.ps1" "CompressMerge.shtml"
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  PID:2968
- C:\Program Files\7-Zip\7z.exe
  "C:\Program Files\7-Zip\7z.exe" to -tzip "ConfirmUpdate.ps1" "ConfirmUpdate.M2V"
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  PID:1168
- C:\Program Files\7-Zip\7z.exe
  "C:\Program Files\7-Zip\7z.exe" to -tzip "DisableFind.ps1" "DisableFind.jfif"
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  PID:1712
- C:\Program Files\7-Zip\7z.exe
  "C:\Program Files\7-Zip\7z.exe" to -tzip "EditOut.ps1" "EditOut.raw"
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  PID:1700
- C:\Program Files\7-Zip\7z.exe
  "C:\Program Files\7-Zip\7z.exe" to -tzip "GetLimit.ps1" "GetLimit.ps1"
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  PID:4724
- C:\Program Files\7-Zip\7z.exe
  "C:\Program Files\7-Zip\7z.exe" to -tzip "ImportWait.ps1" "ImportWait.tif"
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  PID:2296
- C:\Program Files\7-Zip\7z.exe
  "C:\Program Files\7-Zip\7z.exe" to -tzip "InstallFind.ps1" "InstallFind.ram"
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  PID:456
- C:\Program Files\7-Zip\7z.exe
  "C:\Program Files\7-Zip\7z.exe" to -tzip "LockFind.ps1" "LockFind.ppt"
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  PID:4680
- C:\Program Files\7-Zip\7z.exe
  "C:\Program Files\7-Zip\7z.exe" to -tzip "MeasureRequest.ps1" "MeasureRequest.M2V"
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  PID:3864
- C:\Program Files\7-Zip\7z.exe
  "C:\Program Files\7-Zip\7z.exe" to -tzip "Microsoft Edge.ps1" "Microsoft Edge.lnk"
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  PID:2472
- C:\Program Files\7-Zip\7z.exe
  "C:\Program Files\7-Zip\7z.exe" to -tzip "PingFind.ps1" "PingFind.lock"
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  PID:3244
- C:\Program Files\7-Zip\7z.exe
  "C:\Program Files\7-Zip\7z.exe" to -tzip "ProtectResume.ps1" "ProtectResume.bmp"
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  PID:2964
- C:\Program Files\7-Zip\7z.exe
  "C:\Program Files\7-Zip\7z.exe" to -tzip "ResizeInvoke.ps1" "ResizeInvoke.dxf"
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  PID:2036
- C:\Program Files\7-Zip\7z.exe
  "C:\Program Files\7-Zip\7z.exe" to -tzip "RevokeInstall.ps1" "RevokeInstall.aifc"
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  PID:3292
- C:\Program Files\7-Zip\7z.exe
  "C:\Program Files\7-Zip\7z.exe" to -tzip "SyncUnregister.ps1" "SyncUnregister.wmf"
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  PID:1068
- C:\Program Files\7-Zip\7z.exe
  "C:\Program Files\7-Zip\7z.exe" to -tzip "TraceClose.ps1" "TraceClose.AAC"
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  PID:4352
- C:\Program Files\7-Zip\7z.exe
  "C:\Program Files\7-Zip\7z.exe" to -tzip "UnblockSave.ps1" "UnblockSave.tiff"
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  PID:4076
- C:\Program Files\7-Zip\7z.exe
  "C:\Program Files\7-Zip\7z.exe" to -tzip "UndoAdd.ps1" "UndoAdd.mpe"
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  PID:228
- C:\Program Files\7-Zip\7z.exe
  "C:\Program Files\7-Zip\7z.exe" to -tzip "UndoSearch.ps1" "UndoSearch.xltm"
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  PID:2168
- C:\Program Files\7-Zip\7z.exe
  "C:\Program Files\7-Zip\7z.exe" to -tzip "UnlockBackup.ps1" "UnlockBackup.m4v"
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  PID:3288
- C:\Program Files\7-Zip\7z.exe
  "C:\Program Files\7-Zip\7z.exe" to -tzip "UnlockSelect.ps1" "UnlockSelect.docx"
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  PID:5004
- C:\Program Files\7-Zip\7z.exe
  "C:\Program Files\7-Zip\7z.exe" to -tzip "UnprotectEnter.ps1" "UnprotectEnter.wmf"
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  PID:1980
- C:\Program Files\7-Zip\7z.exe
  "C:\Program Files\7-Zip\7z.exe" to -tzip "UseSkip.ps1" "UseSkip.pdf"
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  PID:4516
- C:\Program Files\7-Zip\7z.exe
  "C:\Program Files\7-Zip\7z.exe" to -tzip "WriteResize.ps1" "WriteResize.ogg"
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  PID:468
- C:\Windows\system32\PING.EXE
  ping 127.0.0.1 -n 3
  2⤵
  - Runs ping.exe
  PID:1832
- C:\Windows\system32\shutdown.exe
  shutdown /r /t 0
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  PID:4192

C:\Windows\system32\LogonUI.exe
"LogonUI.exe" /flags:0x4 /state0:0xa39b9055 /state1:0x41c64e6d
1⤵
- Modifies data under HKEY_USERS
- Suspicious use of SetWindowsHookEx
PID:4068

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Remote System Discovery

T1018

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Windows 7 deprecation

Loading Replay Monitor...

Analysis

Sharing

Errors

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads