Analysis
-
max time kernel
0s -
platform
windows10-1703_x64 -
resource
win10-20240404-en -
resource tags
arch:x64arch:x86image:win10-20240404-enlocale:en-usos:windows10-1703-x64system -
submitted
19-09-2024 05:08
Static task
static1
Behavioral task
behavioral1
Sample
Loli.bat
Resource
win10-20240404-en
windows10-1703-x64
2 signatures
150 seconds
General
-
Target
Loli.bat
-
Size
4.8MB
-
MD5
bd56355f83759dc48d75696e0b644e8a
-
SHA1
68cd073196540ae55d8286c2db6a834bd6240220
-
SHA256
ddd3356803592f4ba188cf23f7f1b9176dd9a6d09d659d3c109bbdaa3e221d19
-
SHA512
80aabacc031a905f44199980d8f7a2f661994083e7b8f18ba9f7f961e6046a78c5f68fd4795f43e8c4fe3b7ac0d1b6250d5787bfe0392ff99dbf723fb12df22d
-
SSDEEP
49152:XcBvPfUX7znwOo4OOfdytbLumyQdXogRl6dxIRKm9BMvCZZWxBuscSsJtXXCys:l
Score
1/10
Malware Config
Signatures
-
Suspicious use of AdjustPrivilegeToken 42 IoCs
description pid Process Token: SeIncreaseQuotaPrivilege 5028 WMIC.exe Token: SeSecurityPrivilege 5028 WMIC.exe Token: SeTakeOwnershipPrivilege 5028 WMIC.exe Token: SeLoadDriverPrivilege 5028 WMIC.exe Token: SeSystemProfilePrivilege 5028 WMIC.exe Token: SeSystemtimePrivilege 5028 WMIC.exe Token: SeProfSingleProcessPrivilege 5028 WMIC.exe Token: SeIncBasePriorityPrivilege 5028 WMIC.exe Token: SeCreatePagefilePrivilege 5028 WMIC.exe Token: SeBackupPrivilege 5028 WMIC.exe Token: SeRestorePrivilege 5028 WMIC.exe Token: SeShutdownPrivilege 5028 WMIC.exe Token: SeDebugPrivilege 5028 WMIC.exe Token: SeSystemEnvironmentPrivilege 5028 WMIC.exe Token: SeRemoteShutdownPrivilege 5028 WMIC.exe Token: SeUndockPrivilege 5028 WMIC.exe Token: SeManageVolumePrivilege 5028 WMIC.exe Token: 33 5028 WMIC.exe Token: 34 5028 WMIC.exe Token: 35 5028 WMIC.exe Token: 36 5028 WMIC.exe Token: SeIncreaseQuotaPrivilege 5028 WMIC.exe Token: SeSecurityPrivilege 5028 WMIC.exe Token: SeTakeOwnershipPrivilege 5028 WMIC.exe Token: SeLoadDriverPrivilege 5028 WMIC.exe Token: SeSystemProfilePrivilege 5028 WMIC.exe Token: SeSystemtimePrivilege 5028 WMIC.exe Token: SeProfSingleProcessPrivilege 5028 WMIC.exe Token: SeIncBasePriorityPrivilege 5028 WMIC.exe Token: SeCreatePagefilePrivilege 5028 WMIC.exe Token: SeBackupPrivilege 5028 WMIC.exe Token: SeRestorePrivilege 5028 WMIC.exe Token: SeShutdownPrivilege 5028 WMIC.exe Token: SeDebugPrivilege 5028 WMIC.exe Token: SeSystemEnvironmentPrivilege 5028 WMIC.exe Token: SeRemoteShutdownPrivilege 5028 WMIC.exe Token: SeUndockPrivilege 5028 WMIC.exe Token: SeManageVolumePrivilege 5028 WMIC.exe Token: 33 5028 WMIC.exe Token: 34 5028 WMIC.exe Token: 35 5028 WMIC.exe Token: 36 5028 WMIC.exe -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 5064 wrote to memory of 5028 5064 cmd.exe 74 PID 5064 wrote to memory of 5028 5064 cmd.exe 74 PID 5064 wrote to memory of 96 5064 cmd.exe 75 PID 5064 wrote to memory of 96 5064 cmd.exe 75
Processes
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\Loli.bat"1⤵
- Suspicious use of WriteProcessMemory
PID:5064 -
C:\Windows\System32\Wbem\WMIC.exewmic diskdrive get Model2⤵
- Suspicious use of AdjustPrivilegeToken
PID:5028
-
-
C:\Windows\system32\findstr.exefindstr /i "DADY HARDDISK QEMU HARDDISK WDC WDS100T2B0A"2⤵PID:96
-