Analysis
-
max time kernel
120s -
max time network
120s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system -
submitted
19/09/2024, 12:21
Static task
static1
Behavioral task
behavioral1
Sample
s.bat
Resource
win7-20240903-en
windows7-x64
4 signatures
150 seconds
Behavioral task
behavioral2
Sample
s.bat
Resource
win10v2004-20240802-en
windows10-2004-x64
5 signatures
150 seconds
General
-
Target
s.bat
-
Size
120B
-
MD5
224aaec28d15b95d91d5ebe117206cf1
-
SHA1
96730556f7780b9b30d52504933bd0510f6413ce
-
SHA256
7e2de970d2f583b46d5cd5b74a5b49aca18cbeb2efb5cbe2295a46e16be9c220
-
SHA512
a16bb87eee214e541865e0ead2656643fc6ac56c74296977eb2315537a66f620734776cc44c158c786e64799b38cba30e93fcdbde590c676b5fa1aaf18641a88
Score
1/10
Malware Config
Signatures
-
Detects videocard installed 1 TTPs 1 IoCs
Uses WMIC.exe to determine videocard installed.
pid Process 1816 WMIC.exe -
Gathers system information 1 TTPs 1 IoCs
Runs systeminfo.exe.
pid Process 2872 systeminfo.exe -
Suspicious use of AdjustPrivilegeToken 40 IoCs
description pid Process Token: SeIncreaseQuotaPrivilege 1816 WMIC.exe Token: SeSecurityPrivilege 1816 WMIC.exe Token: SeTakeOwnershipPrivilege 1816 WMIC.exe Token: SeLoadDriverPrivilege 1816 WMIC.exe Token: SeSystemProfilePrivilege 1816 WMIC.exe Token: SeSystemtimePrivilege 1816 WMIC.exe Token: SeProfSingleProcessPrivilege 1816 WMIC.exe Token: SeIncBasePriorityPrivilege 1816 WMIC.exe Token: SeCreatePagefilePrivilege 1816 WMIC.exe Token: SeBackupPrivilege 1816 WMIC.exe Token: SeRestorePrivilege 1816 WMIC.exe Token: SeShutdownPrivilege 1816 WMIC.exe Token: SeDebugPrivilege 1816 WMIC.exe Token: SeSystemEnvironmentPrivilege 1816 WMIC.exe Token: SeRemoteShutdownPrivilege 1816 WMIC.exe Token: SeUndockPrivilege 1816 WMIC.exe Token: SeManageVolumePrivilege 1816 WMIC.exe Token: 33 1816 WMIC.exe Token: 34 1816 WMIC.exe Token: 35 1816 WMIC.exe Token: SeIncreaseQuotaPrivilege 1816 WMIC.exe Token: SeSecurityPrivilege 1816 WMIC.exe Token: SeTakeOwnershipPrivilege 1816 WMIC.exe Token: SeLoadDriverPrivilege 1816 WMIC.exe Token: SeSystemProfilePrivilege 1816 WMIC.exe Token: SeSystemtimePrivilege 1816 WMIC.exe Token: SeProfSingleProcessPrivilege 1816 WMIC.exe Token: SeIncBasePriorityPrivilege 1816 WMIC.exe Token: SeCreatePagefilePrivilege 1816 WMIC.exe Token: SeBackupPrivilege 1816 WMIC.exe Token: SeRestorePrivilege 1816 WMIC.exe Token: SeShutdownPrivilege 1816 WMIC.exe Token: SeDebugPrivilege 1816 WMIC.exe Token: SeSystemEnvironmentPrivilege 1816 WMIC.exe Token: SeRemoteShutdownPrivilege 1816 WMIC.exe Token: SeUndockPrivilege 1816 WMIC.exe Token: SeManageVolumePrivilege 1816 WMIC.exe Token: 33 1816 WMIC.exe Token: 34 1816 WMIC.exe Token: 35 1816 WMIC.exe -
Suspicious use of WriteProcessMemory 6 IoCs
description pid Process procid_target PID 2508 wrote to memory of 1816 2508 cmd.exe 31 PID 2508 wrote to memory of 1816 2508 cmd.exe 31 PID 2508 wrote to memory of 1816 2508 cmd.exe 31 PID 2168 wrote to memory of 2872 2168 cmd.exe 35 PID 2168 wrote to memory of 2872 2168 cmd.exe 35 PID 2168 wrote to memory of 2872 2168 cmd.exe 35
Processes
-
C:\Windows\system32\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\s.bat"1⤵
- Suspicious use of WriteProcessMemory
PID:2508 -
C:\Windows\System32\Wbem\WMIC.exewmic path win32_videocontroller get name,driverversion,videoprocessor,adapterram,availability,caption,description2⤵
- Detects videocard installed
- Suspicious use of AdjustPrivilegeToken
PID:1816
-
-
C:\Windows\system32\cmd.exe"C:\Windows\system32\cmd.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:2168 -
C:\Windows\system32\systeminfo.exesysteminfo2⤵
- Gathers system information
PID:2872
-