15082d63b8d260ab182000b054b43679961bb1086ea8fdfdd53833e6148b3c55

Analysis

max time kernel
120s
max time network
121s
platform
windows7_x64
resource
win7-20240708-en
resource tags

arch:x64arch:x86image:win7-20240708-enlocale:en-usos:windows7-x64system
submitted
14-09-2024 07:21

Target

Flexlm/RLM_Redshift_LicServer/stop_rlm_Redshift.bat
Size

871B
MD5

dd42a41304b17ecffaed8c5c41a425cc
SHA1

08facc23eb93a58b816384533e4c16c975bdeabd
SHA256

ecd34db7e7aff5aa843f048b64f76ad19c4123d6d77616855a8613eb0c111458
SHA512

ca8c16242aed2b842d6e7859109d4ea5c9efb435773af0b52304f9531274f57b50883ea6950e2672ec5fc3dd3f7503f57e04d21122b5417d3e6a7e398245bfd9

Score

8^/10

Stops running service(s) 4 TTPs
evasion execution

Windows Service
T1543.003

Impair Defenses
T1562

Service Stop
T1489

Service Execution
T1569.002

Enumerates processes with tasklist 1 TTPs 1 IoCs

Process Discovery

pid	Process
2412	tasklist.exe

Launches sc.exe 1 IoCs

Sc.exe is a Windows utlilty to control services on the system.

pid	Process
1268	sc.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	2412	tasklist.exe

Suspicious use of WriteProcessMemory 15 IoCs

description	pid	Process	procid_target
PID 1728 wrote to memory of 2960	1728	cmd.exe	31
PID 1728 wrote to memory of 2960	1728	cmd.exe	31
PID 1728 wrote to memory of 2960	1728	cmd.exe	31
PID 2960 wrote to memory of 2384	2960	net.exe	32
PID 2960 wrote to memory of 2384	2960	net.exe	32
PID 2960 wrote to memory of 2384	2960	net.exe	32
PID 1728 wrote to memory of 2412	1728	cmd.exe	33
PID 1728 wrote to memory of 2412	1728	cmd.exe	33
PID 1728 wrote to memory of 2412	1728	cmd.exe	33
PID 1728 wrote to memory of 2524	1728	cmd.exe	34
PID 1728 wrote to memory of 2524	1728	cmd.exe	34
PID 1728 wrote to memory of 2524	1728	cmd.exe	34
PID 1728 wrote to memory of 1268	1728	cmd.exe	36
PID 1728 wrote to memory of 1268	1728	cmd.exe	36
PID 1728 wrote to memory of 1268	1728	cmd.exe	36

C:\Windows\system32\cmd.exe
cmd /c "C:\Users\Admin\AppData\Local\Temp\Flexlm\RLM_Redshift_LicServer\stop_rlm_Redshift.bat"
1⤵
- Suspicious use of WriteProcessMemory
PID:1728
- C:\Windows\system32\net.exe
  C:\Windows\system32\net stop RLM-Redshift
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2960
- - C:\Windows\system32\net1.exe
    C:\Windows\system32\net1 stop RLM-Redshift
    3⤵
    PID:2384
- C:\Windows\system32\tasklist.exe
  tasklist
  2⤵
  - Enumerates processes with tasklist
  - Suspicious use of AdjustPrivilegeToken
  PID:2412
- C:\Windows\system32\find.exe
  find /i "CGHotman_Redshift_Server.exe"
  2⤵
  PID:2524
- C:\Windows\system32\sc.exe
  SC delete RLM-Redshift
  2⤵
  - Launches sc.exe
  PID:1268