Overview

overview

8

Static

static

1

sus.bat

windows7-x64

8

Analysis

  • max time kernel
    155s
  • max time network
    146s
  • platform
    windows7_x64
  • resource
    win7-20240729-en
  • resource tags

    arch:x64arch:x86image:win7-20240729-enlocale:en-usos:windows7-x64system
  • submitted
    08/08/2024, 20:58

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    sus.bat

  • Size

    262B

  • MD5

    43e1aac96df2f4c1a5a82356fe787f7f

  • SHA1

    d44e20b7fdab20b9b6924147dc4a4c0b2b11af37

  • SHA256

    64c4b723188aecf07f98ffe05d74f8e5597e2c41740edd1bff09eaa3c0f7a539

  • SHA512

    5998d05695d32ba030cd1198205d6a275aa3fd0efaed8df27b9b6aa50c9e5a73a249bd1cfcad0cadc8a00d22e7a7db61e4da8f7a2aeb55da0e37b6e956992bb4

Score
8/10
persistence

Malware Config

Signatures

  • Boot or Logon Autostart Execution: Active Setup 2 TTPs 2 IoCs

    Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

    persistence
  • Modifies registry class 10 IoCs
  • Opens file in notepad (likely ransom note) 3 IoCs
    ransomware
  • Suspicious use of AdjustPrivilegeToken 27 IoCs
  • Suspicious use of FindShellTrayWindow 30 IoCs
  • Suspicious use of SendNotifyMessage 64 IoCs
  • Uses Task Scheduler COM API 1 TTPs

    The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.

    persistence

Processes

  • C:\Windows\system32\cmd.exe
    cmd /c "C:\Users\Admin\AppData\Local\Temp\sus.bat"
    1⤵
      PID:624
    • C:\Windows\system32\NOTEPAD.EXE
      "C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\Desktop\virus60\message.txt
      1⤵
      • Opens file in notepad (likely ransom note)
      PID:1968
    • C:\Windows\system32\NOTEPAD.EXE
      "C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\Desktop\virus20\message.txt
      1⤵
      • Opens file in notepad (likely ransom note)
      PID:2880
    • C:\Users\Admin\AppData\Local\Temp\ose00000.exe
      "C:\Users\Admin\AppData\Local\Temp\ose00000.exe"
      1⤵
        PID:836
      • C:\Windows\system32\cmd.exe
        cmd /c ""C:\Users\Admin\AppData\Local\Temp\sus.bat" "
        1⤵
          PID:996
        • C:\Users\Admin\AppData\Local\Temp\ose00000.exe
          "C:\Users\Admin\AppData\Local\Temp\ose00000.exe"
          1⤵
            PID:1656
          • C:\Windows\system32\NOTEPAD.EXE
            "C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\AppData\Local\Temp\ASPNETSetup_00001.log
            1⤵
            • Opens file in notepad (likely ransom note)
            PID:2928
          • C:\Windows\system32\AUDIODG.EXE
            C:\Windows\system32\AUDIODG.EXE 0x4f8
            1⤵
            • Suspicious use of AdjustPrivilegeToken
            PID:2000
          • C:\Windows\system32\NOTEPAD.EXE
            "C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\AppData\Local\Temp\SetupExe(2024072916192591C).log
            1⤵
              PID:2116
            • C:\Windows\system32\NOTEPAD.EXE
              "C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\AppData\Local\Temp\SetupExe(2024072916192591C).log
              1⤵
                PID:2788
              • C:\Windows\system32\NOTEPAD.EXE
                "C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\AppData\Local\Temp\SetupExe(2024072916192591C).log
                1⤵
                  PID:1008
                • C:\Windows\system32\NOTEPAD.EXE
                  "C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\AppData\Local\Temp\SetupExe(2024072916192591C).log
                  1⤵
                    PID:1912
                  • C:\Windows\system32\NOTEPAD.EXE
                    "C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\AppData\Local\Temp\SetupExe(2024072916192591C).log
                    1⤵
                      PID:2948
                    • C:\Windows\system32\NOTEPAD.EXE
                      "C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\AppData\Local\Temp\SetupExe(2024072916192591C).log
                      1⤵
                        PID:3020
                      • C:\Windows\system32\NOTEPAD.EXE
                        "C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\AppData\Local\Temp\SetupExe(2024072916192591C).log
                        1⤵
                          PID:1968
                        • C:\Windows\system32\NOTEPAD.EXE
                          "C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\AppData\Local\Temp\SetupExe(2024072916192591C).log
                          1⤵
                            PID:2600
                          • C:\Windows\explorer.exe
                            explorer.exe
                            1⤵
                            • Boot or Logon Autostart Execution: Active Setup
                            • Modifies registry class
                            • Suspicious use of AdjustPrivilegeToken
                            • Suspicious use of FindShellTrayWindow
                            • Suspicious use of SendNotifyMessage
                            PID:3048
                          • C:\Windows\explorer.exe
                            explorer.exe
                            1⤵
                            • Boot or Logon Autostart Execution: Active Setup
                            • Modifies registry class
                            • Suspicious use of AdjustPrivilegeToken
                            • Suspicious use of FindShellTrayWindow
                            • Suspicious use of SendNotifyMessage
                            PID:2236

                          Network

                          MITRE ATT&CK Enterprise v15

                          Replay Monitor

                          Loading Replay Monitor...

                          Downloads

                          • C:\Users\Admin\Desktop\virus859\message.txt
                            Filesize

                            18B

                            MD5

                            6a6e4723bafd2f942ad2f82004d44dac

                            SHA1

                            dd74522bc7cd651220620237bd9624f4e245814f

                            SHA256

                            63600bff370d8ecd43024de7dd4467899f45e7d2e87c5f5f6cdab249fd6eaa1f

                            SHA512

                            5e280449917b727b659a42cb5c007eb99a7e24fad816fe11806f51f76895a6791252e5d04304c09ba03eab766b6ef24efb3735cb399b7ab0db8278f4b2ee02b2

                            Download Submit