e66264065923676807fd6d7b36f7c9dc52db9ef1c5399b2811738eb5e22a30f6 | Triage

Analysis

max time kernel
139s
max time network
126s
platform
windows10-2004_x64
resource
win10v2004-20240709-en
resource tags

arch:x64arch:x86image:win10v2004-20240709-enlocale:en-usos:windows10-2004-x64system
submitted
23-07-2024 00:03

Sharing

Report Analysis Logs

General

Target

Desktop Goose v0.31/DesktopGoose v0.31/Close Goose.bat
Size

31B
MD5

1fdef6890e156b9aa7b662a4314dc712
SHA1

0c1e18150345fc43924c96844b8fd0fc53ec8855
SHA256

9d3b5a6370f076a57651fcf06fc4f3fbce8d9e5156642e22141a8f521f35ffdc
SHA512

474b7169f7a2deca1298391c42b0d5a8cb55b33853eaf1d79026c9b9b45d9a687582a0aa0d0ff639e5d9b40535cda3b3827546d26f1d35fa9169bcd73f050d29

Score

1^/10

Malware Config

Signatures

Kills process with taskkill 1 IoCs

pid	Process
2424	taskkill.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	2424	taskkill.exe

Suspicious use of WriteProcessMemory 2 IoCs

description	pid	Process	procid_target
PID 1976 wrote to memory of 2424	1976	cmd.exe	86
PID 1976 wrote to memory of 2424	1976	cmd.exe	86

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\Desktop Goose v0.31\DesktopGoose v0.31\Close Goose.bat"
1⤵
- Suspicious use of WriteProcessMemory
PID:1976
- C:\Windows\system32\taskkill.exe
  taskkill /f /im goosedesktop.exe
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:2424

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads