Analysis
-
max time kernel
5s -
max time network
9s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system -
submitted
08-09-2024 14:53
Static task
static1
Behavioral task
behavioral1
Sample
file.bat
Resource
win7-20240903-en
windows7-x64
2 signatures
150 seconds
Behavioral task
behavioral2
Sample
file.bat
Resource
win10v2004-20240802-en
windows10-2004-x64
4 signatures
150 seconds
Errors
Reason
Machine shutdown
General
-
Target
file.bat
-
Size
60B
-
MD5
e70406cdd3806a9c6430829019cdf342
-
SHA1
6bc458e79b12cfeb7db48fae217a04225a9a9d04
-
SHA256
a85471d7cb78d7676346fb6f78efba16708dbaa7b7d818c0fc999a047ed17b91
-
SHA512
9627fc4e8f336b4662e2b8639b680c5d6d4205a59579c0d6c19121fb7c8d8053c93938fcd25b58fc3ec758adef567f7b650e183ca56ac48ff5c0774b5b866e94
Score
1/10
Malware Config
Signatures
-
Suspicious use of AdjustPrivilegeToken 2 IoCs
description pid Process Token: SeShutdownPrivilege 1744 shutdown.exe Token: SeRemoteShutdownPrivilege 1744 shutdown.exe -
Suspicious use of WriteProcessMemory 3 IoCs
description pid Process procid_target PID 2108 wrote to memory of 1744 2108 cmd.exe 31 PID 2108 wrote to memory of 1744 2108 cmd.exe 31 PID 2108 wrote to memory of 1744 2108 cmd.exe 31
Processes
-
C:\Windows\system32\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\file.bat"1⤵
- Suspicious use of WriteProcessMemory
PID:2108 -
C:\Windows\system32\shutdown.exeshutdown -r -t 02⤵
- Suspicious use of AdjustPrivilegeToken
PID:1744
-
-
C:\Windows\system32\LogonUI.exe"LogonUI.exe" /flags:0x01⤵PID:2808
-
C:\Windows\system32\LogonUI.exe"LogonUI.exe" /flags:0x11⤵PID:2636