fc177447cdf3ff84cf9c88ab9692242e525b00ea5067e4bc3773823ac9305253

Analysis

max time kernel
137s
max time network
110s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
20-08-2024 20:29

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

Astral Spoofer/Serialchecker.bat
Size

2KB
MD5

75e8ac5bdef839ba34532b69e1f3feb4
SHA1

beae4fe06294e10fc2831a45f2f8436cae449bf2
SHA256

c7a86fb9f079249b3bd525ea13128da103fc0bdb4764cdbbc48c8e505b0f1429
SHA512

1525242c0ae50ec12312eef0ce8be4dcf166ffb3162963e6f81f1fa230e2038a70a19f82501118ada5fef48fa8d32c1c24b2aebf08a096da8b8dcf393aed4509

Score

1^/10

Malware Config

Signatures

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeIncreaseQuotaPrivilege	3948	WMIC.exe
Token: SeSecurityPrivilege	3948	WMIC.exe
Token: SeTakeOwnershipPrivilege	3948	WMIC.exe
Token: SeLoadDriverPrivilege	3948	WMIC.exe
Token: SeSystemProfilePrivilege	3948	WMIC.exe
Token: SeSystemtimePrivilege	3948	WMIC.exe
Token: SeProfSingleProcessPrivilege	3948	WMIC.exe
Token: SeIncBasePriorityPrivilege	3948	WMIC.exe
Token: SeCreatePagefilePrivilege	3948	WMIC.exe
Token: SeBackupPrivilege	3948	WMIC.exe
Token: SeRestorePrivilege	3948	WMIC.exe
Token: SeShutdownPrivilege	3948	WMIC.exe
Token: SeDebugPrivilege	3948	WMIC.exe
Token: SeSystemEnvironmentPrivilege	3948	WMIC.exe
Token: SeRemoteShutdownPrivilege	3948	WMIC.exe
Token: SeUndockPrivilege	3948	WMIC.exe
Token: SeManageVolumePrivilege	3948	WMIC.exe
Token: 33	3948	WMIC.exe
Token: 34	3948	WMIC.exe
Token: 35	3948	WMIC.exe
Token: 36	3948	WMIC.exe
Token: SeIncreaseQuotaPrivilege	3948	WMIC.exe
Token: SeSecurityPrivilege	3948	WMIC.exe
Token: SeTakeOwnershipPrivilege	3948	WMIC.exe
Token: SeLoadDriverPrivilege	3948	WMIC.exe
Token: SeSystemProfilePrivilege	3948	WMIC.exe
Token: SeSystemtimePrivilege	3948	WMIC.exe
Token: SeProfSingleProcessPrivilege	3948	WMIC.exe
Token: SeIncBasePriorityPrivilege	3948	WMIC.exe
Token: SeCreatePagefilePrivilege	3948	WMIC.exe
Token: SeBackupPrivilege	3948	WMIC.exe
Token: SeRestorePrivilege	3948	WMIC.exe
Token: SeShutdownPrivilege	3948	WMIC.exe
Token: SeDebugPrivilege	3948	WMIC.exe
Token: SeSystemEnvironmentPrivilege	3948	WMIC.exe
Token: SeRemoteShutdownPrivilege	3948	WMIC.exe
Token: SeUndockPrivilege	3948	WMIC.exe
Token: SeManageVolumePrivilege	3948	WMIC.exe
Token: 33	3948	WMIC.exe
Token: 34	3948	WMIC.exe
Token: 35	3948	WMIC.exe
Token: 36	3948	WMIC.exe
Token: SeIncreaseQuotaPrivilege	1768	WMIC.exe
Token: SeSecurityPrivilege	1768	WMIC.exe
Token: SeTakeOwnershipPrivilege	1768	WMIC.exe
Token: SeLoadDriverPrivilege	1768	WMIC.exe
Token: SeSystemProfilePrivilege	1768	WMIC.exe
Token: SeSystemtimePrivilege	1768	WMIC.exe
Token: SeProfSingleProcessPrivilege	1768	WMIC.exe
Token: SeIncBasePriorityPrivilege	1768	WMIC.exe
Token: SeCreatePagefilePrivilege	1768	WMIC.exe
Token: SeBackupPrivilege	1768	WMIC.exe
Token: SeRestorePrivilege	1768	WMIC.exe
Token: SeShutdownPrivilege	1768	WMIC.exe
Token: SeDebugPrivilege	1768	WMIC.exe
Token: SeSystemEnvironmentPrivilege	1768	WMIC.exe
Token: SeRemoteShutdownPrivilege	1768	WMIC.exe
Token: SeUndockPrivilege	1768	WMIC.exe
Token: SeManageVolumePrivilege	1768	WMIC.exe
Token: 33	1768	WMIC.exe
Token: 34	1768	WMIC.exe
Token: 35	1768	WMIC.exe
Token: 36	1768	WMIC.exe
Token: SeIncreaseQuotaPrivilege	1768	WMIC.exe

Suspicious use of WriteProcessMemory 16 IoCs

description	pid	Process	procid_target
PID 3892 wrote to memory of 4084	3892	cmd.exe	85
PID 3892 wrote to memory of 4084	3892	cmd.exe	85
PID 3892 wrote to memory of 3948	3892	cmd.exe	94
PID 3892 wrote to memory of 3948	3892	cmd.exe	94
PID 3892 wrote to memory of 1768	3892	cmd.exe	95
PID 3892 wrote to memory of 1768	3892	cmd.exe	95
PID 3892 wrote to memory of 3052	3892	cmd.exe	96
PID 3892 wrote to memory of 3052	3892	cmd.exe	96
PID 3892 wrote to memory of 1244	3892	cmd.exe	97
PID 3892 wrote to memory of 1244	3892	cmd.exe	97
PID 3892 wrote to memory of 1056	3892	cmd.exe	98
PID 3892 wrote to memory of 1056	3892	cmd.exe	98
PID 3892 wrote to memory of 1696	3892	cmd.exe	99
PID 3892 wrote to memory of 1696	3892	cmd.exe	99
PID 3892 wrote to memory of 3960	3892	cmd.exe	100
PID 3892 wrote to memory of 3960	3892	cmd.exe	100

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\Astral Spoofer\Serialchecker.bat"
1⤵
- Suspicious use of WriteProcessMemory
PID:3892
- C:\Windows\system32\cscript.exe
  cscript //nologo "C:\temp\popup.vbs"
  2⤵
  PID:4084
- C:\Windows\System32\Wbem\WMIC.exe
  wmic baseboard get serialnumber
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  PID:3948
- C:\Windows\System32\Wbem\WMIC.exe
  wmic systemenclosure get serialnumber
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  PID:1768
- C:\Windows\System32\Wbem\WMIC.exe
  wmic path win32_computersystemproduct get uuid
  2⤵
  PID:3052
- C:\Windows\System32\Wbem\WMIC.exe
  wmic bios get serialnumber
  2⤵
  PID:1244
- C:\Windows\System32\Wbem\WMIC.exe
  wmic cpu get serialnumber
  2⤵
  PID:1056
- C:\Windows\system32\reg.exe
  reg query "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion" /v ProductID
  2⤵
  PID:1696
- C:\Windows\system32\getmac.exe
  getmac
  2⤵
  PID:3960

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

C:\temp\popup.vbs

Filesize
70B

MD5
9fe33444e664a4246806a7161b132ff0

SHA1
2eb9f6c328b9d6606334488caf58900abb10a63e

SHA256
01b4547b1bedd429f4affc1e3014bf3fd415d491a0c2208f625fa2ddf95883bc

SHA512
d1a9d6f9612c8ce56c81df7684b9b774483e9cd717a64f310b23d44efc4a657fd903e4cfa207ebfb7a938cdf657be3e94344eed9bef26a1ddb886c4b5ced7bc2

Download Submit

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads