1d5856cebe9f2edd914f2b689fbbe5da602bcdf29d81d116a9f10433b085674b | Triage

Analysis

max time kernel
3s
max time network
3s
platform
windows7_x64
resource
win7-20240729-en
resource tags

arch:x64arch:x86image:win7-20240729-enlocale:en-usos:windows7-x64system
submitted
05/08/2024, 08:28

Sharing

Copy URL Twitter E-mail

Reason

Machine shutdown

Report Analysis Logs

General

Target

shut.bat
Size

244B
MD5

e370a5964532512329fc6a0e22a35106
SHA1

476f12369fed17889c33f2723f4d175969f65862
SHA256

1d5856cebe9f2edd914f2b689fbbe5da602bcdf29d81d116a9f10433b085674b
SHA512

45c20495210cec8437abda3054f7147c18de7574ceb533900da12a8b47efafebfef10f8353342f56bf6e9ac24b8fd6f3b4608f1132ea1e81cb4a209caf7126ab

Score

7^/10

Malware Config

Signatures

Drops startup file 2 IoCs

description	ioc	Process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\shut.bat	cmd.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\shut.bat	cmd.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeShutdownPrivilege	2396	shutdown.exe
Token: SeRemoteShutdownPrivilege	2396	shutdown.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2584 wrote to memory of 2396	2584	cmd.exe	31
PID 2584 wrote to memory of 2396	2584	cmd.exe	31
PID 2584 wrote to memory of 2396	2584	cmd.exe	31

C:\Windows\system32\cmd.exe
cmd /c "C:\Users\Admin\AppData\Local\Temp\shut.bat"
1⤵
- Drops startup file
- Suspicious use of WriteProcessMemory
PID:2584
- C:\Windows\system32\shutdown.exe
  shutdown -s -t 0
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  PID:2396

C:\Windows\system32\LogonUI.exe
"LogonUI.exe" /flags:0x0
1⤵
PID:2416

C:\Windows\system32\LogonUI.exe
"LogonUI.exe" /flags:0x1
1⤵
PID:2636

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2416-2-0x0000000002D90000-0x0000000002D91000-memory.dmp

Filesize
4KB

Download
memory/2636-3-0x0000000002B30000-0x0000000002B31000-memory.dmp

Filesize
4KB

Download