Overview
overview
8Static
static
3DriverFN_C...RP.bat
windows7-x64
8DriverFN_C...RP.bat
windows10-2004-x64
8DriverFN_C...AC.bat
windows7-x64
3DriverFN_C...AC.bat
windows10-2004-x64
3DriverFN_C...er.exe
windows7-x64
1DriverFN_C...er.exe
windows10-2004-x64
1DriverFN_C...er.bat
windows7-x64
1DriverFN_C...er.bat
windows10-2004-x64
1Analysis
-
max time kernel
12s -
max time network
19s -
platform
windows7_x64 -
resource
win7-20240704-en -
resource tags
arch:x64arch:x86image:win7-20240704-enlocale:en-usos:windows7-x64system -
submitted
01/09/2024, 14:45
Static task
static1
Behavioral task
behavioral1
Sample
DriverFN_Cracked/NETWORK/ARP.bat
Resource
win7-20240708-en
windows7-x64
Behavioral task
behavioral2
Sample
DriverFN_Cracked/NETWORK/ARP.bat
Resource
win10v2004-20240802-en
windows10-2004-x64
Behavioral task
behavioral3
Sample
DriverFN_Cracked/NETWORK/MAC.bat
Resource
win7-20240729-en
windows7-x64
Behavioral task
behavioral4
Sample
DriverFN_Cracked/NETWORK/MAC.bat
Resource
win10v2004-20240802-en
windows10-2004-x64
Behavioral task
behavioral5
Sample
DriverFN_Cracked/Perm Spoofer.exe
Resource
win7-20240705-en
windows7-x64
Behavioral task
behavioral6
Sample
DriverFN_Cracked/Perm Spoofer.exe
Resource
win10v2004-20240802-en
windows10-2004-x64
Behavioral task
behavioral7
Sample
DriverFN_Cracked/Serials Checker/Serials Checker.bat
Resource
win7-20240704-en
windows7-x64
Behavioral task
behavioral8
Sample
DriverFN_Cracked/Serials Checker/Serials Checker.bat
Resource
win10v2004-20240802-en
windows10-2004-x64
General
-
Target
DriverFN_Cracked/Serials Checker/Serials Checker.bat
-
Size
403B
-
MD5
4d39b88edb3ed7282a587c4805928ecd
-
SHA1
a7399a397a341f6e7048c4376faba21ed4e4a87c
-
SHA256
e4d3e8598d39e70e7005292a9594a90af6ed91488670d47998d8a8f248f7ce9e
-
SHA512
c9607fed93087b6f2d97c5101afc2b6a0410f94f6cf40443efebb811fab7773dc4c529c0214850dae8b0c38b0287fe9cd5b6ecec400a41eb8f1b06facdc40253
Malware Config
Signatures
-
Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeIncreaseQuotaPrivilege 2952 WMIC.exe Token: SeSecurityPrivilege 2952 WMIC.exe Token: SeTakeOwnershipPrivilege 2952 WMIC.exe Token: SeLoadDriverPrivilege 2952 WMIC.exe Token: SeSystemProfilePrivilege 2952 WMIC.exe Token: SeSystemtimePrivilege 2952 WMIC.exe Token: SeProfSingleProcessPrivilege 2952 WMIC.exe Token: SeIncBasePriorityPrivilege 2952 WMIC.exe Token: SeCreatePagefilePrivilege 2952 WMIC.exe Token: SeBackupPrivilege 2952 WMIC.exe Token: SeRestorePrivilege 2952 WMIC.exe Token: SeShutdownPrivilege 2952 WMIC.exe Token: SeDebugPrivilege 2952 WMIC.exe Token: SeSystemEnvironmentPrivilege 2952 WMIC.exe Token: SeRemoteShutdownPrivilege 2952 WMIC.exe Token: SeUndockPrivilege 2952 WMIC.exe Token: SeManageVolumePrivilege 2952 WMIC.exe Token: 33 2952 WMIC.exe Token: 34 2952 WMIC.exe Token: 35 2952 WMIC.exe Token: SeIncreaseQuotaPrivilege 2952 WMIC.exe Token: SeSecurityPrivilege 2952 WMIC.exe Token: SeTakeOwnershipPrivilege 2952 WMIC.exe Token: SeLoadDriverPrivilege 2952 WMIC.exe Token: SeSystemProfilePrivilege 2952 WMIC.exe Token: SeSystemtimePrivilege 2952 WMIC.exe Token: SeProfSingleProcessPrivilege 2952 WMIC.exe Token: SeIncBasePriorityPrivilege 2952 WMIC.exe Token: SeCreatePagefilePrivilege 2952 WMIC.exe Token: SeBackupPrivilege 2952 WMIC.exe Token: SeRestorePrivilege 2952 WMIC.exe Token: SeShutdownPrivilege 2952 WMIC.exe Token: SeDebugPrivilege 2952 WMIC.exe Token: SeSystemEnvironmentPrivilege 2952 WMIC.exe Token: SeRemoteShutdownPrivilege 2952 WMIC.exe Token: SeUndockPrivilege 2952 WMIC.exe Token: SeManageVolumePrivilege 2952 WMIC.exe Token: 33 2952 WMIC.exe Token: 34 2952 WMIC.exe Token: 35 2952 WMIC.exe Token: SeIncreaseQuotaPrivilege 2876 WMIC.exe Token: SeSecurityPrivilege 2876 WMIC.exe Token: SeTakeOwnershipPrivilege 2876 WMIC.exe Token: SeLoadDriverPrivilege 2876 WMIC.exe Token: SeSystemProfilePrivilege 2876 WMIC.exe Token: SeSystemtimePrivilege 2876 WMIC.exe Token: SeProfSingleProcessPrivilege 2876 WMIC.exe Token: SeIncBasePriorityPrivilege 2876 WMIC.exe Token: SeCreatePagefilePrivilege 2876 WMIC.exe Token: SeBackupPrivilege 2876 WMIC.exe Token: SeRestorePrivilege 2876 WMIC.exe Token: SeShutdownPrivilege 2876 WMIC.exe Token: SeDebugPrivilege 2876 WMIC.exe Token: SeSystemEnvironmentPrivilege 2876 WMIC.exe Token: SeRemoteShutdownPrivilege 2876 WMIC.exe Token: SeUndockPrivilege 2876 WMIC.exe Token: SeManageVolumePrivilege 2876 WMIC.exe Token: 33 2876 WMIC.exe Token: 34 2876 WMIC.exe Token: 35 2876 WMIC.exe Token: SeIncreaseQuotaPrivilege 2876 WMIC.exe Token: SeSecurityPrivilege 2876 WMIC.exe Token: SeTakeOwnershipPrivilege 2876 WMIC.exe Token: SeLoadDriverPrivilege 2876 WMIC.exe -
Suspicious use of WriteProcessMemory 15 IoCs
description pid Process procid_target PID 2304 wrote to memory of 2952 2304 cmd.exe 30 PID 2304 wrote to memory of 2952 2304 cmd.exe 30 PID 2304 wrote to memory of 2952 2304 cmd.exe 30 PID 2304 wrote to memory of 2876 2304 cmd.exe 32 PID 2304 wrote to memory of 2876 2304 cmd.exe 32 PID 2304 wrote to memory of 2876 2304 cmd.exe 32 PID 2304 wrote to memory of 3044 2304 cmd.exe 33 PID 2304 wrote to memory of 3044 2304 cmd.exe 33 PID 2304 wrote to memory of 3044 2304 cmd.exe 33 PID 2304 wrote to memory of 2372 2304 cmd.exe 34 PID 2304 wrote to memory of 2372 2304 cmd.exe 34 PID 2304 wrote to memory of 2372 2304 cmd.exe 34 PID 2304 wrote to memory of 2668 2304 cmd.exe 35 PID 2304 wrote to memory of 2668 2304 cmd.exe 35 PID 2304 wrote to memory of 2668 2304 cmd.exe 35
Processes
-
C:\Windows\system32\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\DriverFN_Cracked\Serials Checker\Serials Checker.bat"1⤵
- Suspicious use of WriteProcessMemory
PID:2304 -
C:\Windows\System32\Wbem\WMIC.exewmic cpu get serialnumber2⤵
- Suspicious use of AdjustPrivilegeToken
PID:2952
-
-
C:\Windows\System32\Wbem\WMIC.exewmic bios get serialnumber2⤵
- Suspicious use of AdjustPrivilegeToken
PID:2876
-
-
C:\Windows\System32\Wbem\WMIC.exewmic baseboard get serialnumber2⤵PID:3044
-
-
C:\Windows\System32\Wbem\WMIC.exewmic path win32_computersystemproduct get uuid2⤵PID:2372
-
-
C:\Windows\system32\getmac.exegetmac2⤵PID:2668
-