15082d63b8d260ab182000b054b43679961bb1086ea8fdfdd53833e6148b3c55

Analysis

max time kernel
132s
max time network
134s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
14-09-2024 07:21

Target

Flexlm/RLM_Redshift_LicServer/stop_rlm_Redshift.bat
Size

871B
MD5

dd42a41304b17ecffaed8c5c41a425cc
SHA1

08facc23eb93a58b816384533e4c16c975bdeabd
SHA256

ecd34db7e7aff5aa843f048b64f76ad19c4123d6d77616855a8613eb0c111458
SHA512

ca8c16242aed2b842d6e7859109d4ea5c9efb435773af0b52304f9531274f57b50883ea6950e2672ec5fc3dd3f7503f57e04d21122b5417d3e6a7e398245bfd9

Score

8^/10

Stops running service(s) 4 TTPs
evasion execution

Windows Service
T1543.003

Impair Defenses
T1562

Service Stop
T1489

Service Execution
T1569.002

Enumerates processes with tasklist 1 TTPs 1 IoCs

Process Discovery

pid	Process
3316	tasklist.exe

Launches sc.exe 1 IoCs

Sc.exe is a Windows utlilty to control services on the system.

pid	Process
2348	sc.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	3316	tasklist.exe

Suspicious use of WriteProcessMemory 10 IoCs

description	pid	Process	procid_target
PID 3616 wrote to memory of 1920	3616	cmd.exe	93
PID 3616 wrote to memory of 1920	3616	cmd.exe	93
PID 1920 wrote to memory of 992	1920	net.exe	94
PID 1920 wrote to memory of 992	1920	net.exe	94
PID 3616 wrote to memory of 3316	3616	cmd.exe	95
PID 3616 wrote to memory of 3316	3616	cmd.exe	95
PID 3616 wrote to memory of 5096	3616	cmd.exe	96
PID 3616 wrote to memory of 5096	3616	cmd.exe	96
PID 3616 wrote to memory of 2348	3616	cmd.exe	99
PID 3616 wrote to memory of 2348	3616	cmd.exe	99

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\Flexlm\RLM_Redshift_LicServer\stop_rlm_Redshift.bat"
1⤵
- Suspicious use of WriteProcessMemory
PID:3616
- C:\Windows\system32\net.exe
  C:\Windows\system32\net stop RLM-Redshift
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1920
- - C:\Windows\system32\net1.exe
    C:\Windows\system32\net1 stop RLM-Redshift
    3⤵
    PID:992
- C:\Windows\system32\tasklist.exe
  tasklist
  2⤵
  - Enumerates processes with tasklist
  - Suspicious use of AdjustPrivilegeToken
  PID:3316
- C:\Windows\system32\find.exe
  find /i "CGHotman_Redshift_Server.exe"
  2⤵
  PID:5096
- C:\Windows\system32\sc.exe
  SC delete RLM-Redshift
  2⤵
  - Launches sc.exe
  PID:2348

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --field-trial-handle=4264,i,4174666705242427184,7333705955694532165,262144 --variations-seed-version --mojo-platform-channel-handle=4508 /prefetch:8
1⤵
PID:4904