f08cd592c887920888cb0a18e754231b756e6c285a50511c26f4826dd1581978

Analysis

max time kernel
150s
max time network
204s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
20-09-2024 20:51

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

main.bat
Size

72KB
MD5

35e015a9bcce22c31ba0fb364830c788
SHA1

514cb5bbff59bb0c5aa92074cfa44ed061c3aafb
SHA256

f08cd592c887920888cb0a18e754231b756e6c285a50511c26f4826dd1581978
SHA512

ed48ecef95cd79b9f26de8523d1ae655310ad8b1684e9bbb24103943cb9fa919de826cf667d2f40d5b8cb9aeaef89aec8cdb86aeb957fe6037b4ee77b28a4668
SSDEEP

768:IposY9qsaIZz+QK7ruEDHs2guEDHsaOmh82mnUjQxOn1TS6QBQg+mispepU:ICsYOBm9mnUk01SBQg+miU

Score

10^/10

evasion execution persistence ransomware

Malware Config

Signatures

Disables service(s) 3 TTPs
evasion execution

Windows Service
T1543.003

Service Stop
T1489

Service Execution
T1569.002

Modifies boot configuration data using bcdedit 1 TTPs 2 IoCs

ransomware evasion

Inhibit System Recovery

T1490

pid	Process
1204	bcdedit.exe
220	bcdedit.exe

Stops running service(s) 4 TTPs
evasion execution

Windows Service
T1543.003

Impair Defenses
T1562

Service Stop
T1489

Service Execution
T1569.002

Power Settings 1 TTPs 18 IoCs

powercfg controls all configurable power system settings on a Windows system and can be abused to prevent an infected host from locking or shutting down.

persistence

Power Settings

T1653

pid	Process
5096	powercfg.exe
624	powercfg.exe
1932	powercfg.exe
1064	powercfg.exe
2316	powercfg.exe
2412	powercfg.exe
3036	powercfg.exe
964	powercfg.exe
2932	powercfg.exe
4912	powercfg.exe
5028	powercfg.exe
788	powercfg.exe
3608	powercfg.exe
3324	powercfg.exe
4984	powercfg.exe
4888	powercfg.exe
4796	powercfg.exe
2096	powercfg.exe

Launches sc.exe 10 IoCs

Sc.exe is a Windows utlilty to control services on the system.

pid	Process
3392	sc.exe
3456	sc.exe
1364	sc.exe
4160	sc.exe
1376	sc.exe
1448	sc.exe
5024	sc.exe
4060	sc.exe
2280	sc.exe
3276	sc.exe

Delays execution with timeout.exe 1 IoCs

evasion

pid	Process
932	timeout.exe

Modifies registry key 1 TTPs 1 IoCs

Modify Registry

T1112

pid	Process
1564	reg.exe

Suspicious use of AdjustPrivilegeToken 36 IoCs

description	pid	Process
Token: SeShutdownPrivilege	2316	powercfg.exe
Token: SeCreatePagefilePrivilege	2316	powercfg.exe
Token: SeShutdownPrivilege	5028	powercfg.exe
Token: SeCreatePagefilePrivilege	5028	powercfg.exe
Token: SeShutdownPrivilege	4888	powercfg.exe
Token: SeCreatePagefilePrivilege	4888	powercfg.exe
Token: SeShutdownPrivilege	2412	powercfg.exe
Token: SeCreatePagefilePrivilege	2412	powercfg.exe
Token: SeShutdownPrivilege	624	powercfg.exe
Token: SeCreatePagefilePrivilege	624	powercfg.exe
Token: SeShutdownPrivilege	788	powercfg.exe
Token: SeCreatePagefilePrivilege	788	powercfg.exe
Token: SeShutdownPrivilege	3608	powercfg.exe
Token: SeCreatePagefilePrivilege	3608	powercfg.exe
Token: SeShutdownPrivilege	3036	powercfg.exe
Token: SeCreatePagefilePrivilege	3036	powercfg.exe
Token: SeShutdownPrivilege	1932	powercfg.exe
Token: SeCreatePagefilePrivilege	1932	powercfg.exe
Token: SeShutdownPrivilege	964	powercfg.exe
Token: SeCreatePagefilePrivilege	964	powercfg.exe
Token: SeShutdownPrivilege	4796	powercfg.exe
Token: SeCreatePagefilePrivilege	4796	powercfg.exe
Token: SeShutdownPrivilege	1064	powercfg.exe
Token: SeCreatePagefilePrivilege	1064	powercfg.exe
Token: SeShutdownPrivilege	2096	powercfg.exe
Token: SeCreatePagefilePrivilege	2096	powercfg.exe
Token: SeShutdownPrivilege	2932	powercfg.exe
Token: SeCreatePagefilePrivilege	2932	powercfg.exe
Token: SeShutdownPrivilege	5096	powercfg.exe
Token: SeCreatePagefilePrivilege	5096	powercfg.exe
Token: SeShutdownPrivilege	4912	powercfg.exe
Token: SeCreatePagefilePrivilege	4912	powercfg.exe
Token: SeShutdownPrivilege	3324	powercfg.exe
Token: SeCreatePagefilePrivilege	3324	powercfg.exe
Token: SeShutdownPrivilege	4984	powercfg.exe
Token: SeCreatePagefilePrivilege	4984	powercfg.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2676 wrote to memory of 2352	2676	cmd.exe	83
PID 2676 wrote to memory of 2352	2676	cmd.exe	83
PID 2676 wrote to memory of 4536	2676	cmd.exe	84
PID 2676 wrote to memory of 4536	2676	cmd.exe	84
PID 2676 wrote to memory of 824	2676	cmd.exe	89
PID 2676 wrote to memory of 824	2676	cmd.exe	89
PID 2676 wrote to memory of 2240	2676	cmd.exe	90
PID 2676 wrote to memory of 2240	2676	cmd.exe	90
PID 2676 wrote to memory of 2064	2676	cmd.exe	91
PID 2676 wrote to memory of 2064	2676	cmd.exe	91
PID 2676 wrote to memory of 1752	2676	cmd.exe	92
PID 2676 wrote to memory of 1752	2676	cmd.exe	92
PID 2676 wrote to memory of 4040	2676	cmd.exe	93
PID 2676 wrote to memory of 4040	2676	cmd.exe	93
PID 2676 wrote to memory of 3872	2676	cmd.exe	94
PID 2676 wrote to memory of 3872	2676	cmd.exe	94
PID 2676 wrote to memory of 1564	2676	cmd.exe	95
PID 2676 wrote to memory of 1564	2676	cmd.exe	95
PID 2676 wrote to memory of 2316	2676	cmd.exe	96
PID 2676 wrote to memory of 2316	2676	cmd.exe	96
PID 2676 wrote to memory of 5028	2676	cmd.exe	97
PID 2676 wrote to memory of 5028	2676	cmd.exe	97
PID 2676 wrote to memory of 1204	2676	cmd.exe	98
PID 2676 wrote to memory of 1204	2676	cmd.exe	98
PID 2676 wrote to memory of 220	2676	cmd.exe	99
PID 2676 wrote to memory of 220	2676	cmd.exe	99
PID 2676 wrote to memory of 228	2676	cmd.exe	100
PID 2676 wrote to memory of 228	2676	cmd.exe	100
PID 2676 wrote to memory of 1604	2676	cmd.exe	101
PID 2676 wrote to memory of 1604	2676	cmd.exe	101
PID 2676 wrote to memory of 2220	2676	cmd.exe	102
PID 2676 wrote to memory of 2220	2676	cmd.exe	102
PID 2676 wrote to memory of 4888	2676	cmd.exe	103
PID 2676 wrote to memory of 4888	2676	cmd.exe	103
PID 2676 wrote to memory of 2412	2676	cmd.exe	104
PID 2676 wrote to memory of 2412	2676	cmd.exe	104
PID 2676 wrote to memory of 624	2676	cmd.exe	105
PID 2676 wrote to memory of 624	2676	cmd.exe	105
PID 2676 wrote to memory of 788	2676	cmd.exe	106
PID 2676 wrote to memory of 788	2676	cmd.exe	106
PID 2676 wrote to memory of 3608	2676	cmd.exe	107
PID 2676 wrote to memory of 3608	2676	cmd.exe	107
PID 2676 wrote to memory of 3036	2676	cmd.exe	108
PID 2676 wrote to memory of 3036	2676	cmd.exe	108
PID 2676 wrote to memory of 1932	2676	cmd.exe	109
PID 2676 wrote to memory of 1932	2676	cmd.exe	109
PID 2676 wrote to memory of 964	2676	cmd.exe	110
PID 2676 wrote to memory of 964	2676	cmd.exe	110
PID 2676 wrote to memory of 4796	2676	cmd.exe	111
PID 2676 wrote to memory of 4796	2676	cmd.exe	111
PID 2676 wrote to memory of 1064	2676	cmd.exe	112
PID 2676 wrote to memory of 1064	2676	cmd.exe	112
PID 2676 wrote to memory of 2096	2676	cmd.exe	113
PID 2676 wrote to memory of 2096	2676	cmd.exe	113
PID 2676 wrote to memory of 2932	2676	cmd.exe	114
PID 2676 wrote to memory of 2932	2676	cmd.exe	114
PID 2676 wrote to memory of 5096	2676	cmd.exe	115
PID 2676 wrote to memory of 5096	2676	cmd.exe	115
PID 2676 wrote to memory of 3100	2676	cmd.exe	116
PID 2676 wrote to memory of 3100	2676	cmd.exe	116
PID 2676 wrote to memory of 4912	2676	cmd.exe	117
PID 2676 wrote to memory of 4912	2676	cmd.exe	117
PID 2676 wrote to memory of 3324	2676	cmd.exe	118
PID 2676 wrote to memory of 3324	2676	cmd.exe	118

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\main.bat"
1⤵
- Suspicious use of WriteProcessMemory
PID:2676
- C:\Windows\system32\chcp.com
  chcp 65001
  2⤵
  PID:2352
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c "prompt $H &echo on &for %B in (1) do rem"
  2⤵
  PID:4536
- C:\Windows\system32\reg.exe
  Reg.exe add "HKLM\SYSTEM\ControlSet001\Control\Power\PowerSettings\54533251-82be-4824-96c1-47b60b740d00\0cc5b647-c1df-4637-891a-dec35c318583" /v "ValueMax" /t REG_DWORD /d "0" /f
  2⤵
  PID:824
- C:\Windows\system32\reg.exe
  Reg.exe add "HKLM\SYSTEM\ControlSet001\Control\Power\PowerSettings\54533251-82be-4824-96c1-47b60b740d00\0cc5b647-c1df-4637-891a-dec35c318583" /v "ValueMin" /t REG_DWORD /d "0" /f
  2⤵
  PID:2240
- C:\Windows\system32\reg.exe
  Reg.exe add "HKLM\SYSTEM\ControlSet002\Control\Power\PowerSettings\54533251-82be-4824-96c1-47b60b740d00\0cc5b647-c1df-4637-891a-dec35c318583" /v "ValueMax" /t REG_DWORD /d "0" /f
  2⤵
  PID:2064
- C:\Windows\system32\reg.exe
  Reg.exe add "HKLM\SYSTEM\ControlSet002\Control\Power\PowerSettings\54533251-82be-4824-96c1-47b60b740d00\0cc5b647-c1df-4637-891a-dec35c318583" /v "ValueMin" /t REG_DWORD /d "0" /f
  2⤵
  PID:1752
- C:\Windows\system32\reg.exe
  Reg.exe add "HKLM\SYSTEM\CurrentControlSet\Control\Power\PowerSettings\54533251-82be-4824-96c1-47b60b740d00\0cc5b647-c1df-4637-891a-dec35c318583" /v "ValueMax" /t REG_DWORD /d "0" /f
  2⤵
  PID:4040
- C:\Windows\system32\reg.exe
  Reg.exe add "HKLM\SYSTEM\CurrentControlSet\Control\Power\PowerSettings\54533251-82be-4824-96c1-47b60b740d00\0cc5b647-c1df-4637-891a-dec35c318583" /v "ValueMin" /t REG_DWORD /d "0" /f
  2⤵
  PID:3872
- C:\Windows\system32\reg.exe
  Reg.exe add HKLM\SYSTEM\CurrentControlSet\Control\Power /v CoreParkingDisabled /t REG_DWORD /d 0 /f
  2⤵
  - Modifies registry key
  PID:1564
- C:\Windows\system32\powercfg.exe
  powercfg -setacvalueindex scheme_current sub_processor CPMINCORES 100
  2⤵
  - Power Settings
  - Suspicious use of AdjustPrivilegeToken
  PID:2316
- C:\Windows\system32\powercfg.exe
  powercfg /setactive SCHEME_CURRENT
  2⤵
  - Power Settings
  - Suspicious use of AdjustPrivilegeToken
  PID:5028
- C:\Windows\system32\bcdedit.exe
  bcdedit /set allowedinmemorysettings 0x0
  2⤵
  - Modifies boot configuration data using bcdedit
  PID:1204
- C:\Windows\system32\bcdedit.exe
  bcdedit /set isolatedcontext No
  2⤵
  - Modifies boot configuration data using bcdedit
  PID:220
- C:\Windows\system32\reg.exe
  Reg.exe add "HKLM\SYSTEM\CurrentControlSet\Control\Session Manager\kernel" /v "DistributeTimers" /t REG_DWORD /d "1" /f
  2⤵
  PID:228
- C:\Windows\system32\reg.exe
  Reg.exe add "HKLM\SYSTEM\CurrentControlSet\Control\Session Manager\kernel" /v "DisableTsx" /t REG_DWORD /d "0" /f
  2⤵
  PID:1604
- C:\Windows\system32\reg.exe
  Reg.exe add "HKLM\SYSTEM\CurrentControlSet\Control\Power" /v "EventProcessorEnabled" /t REG_DWORD /d "0" /f
  2⤵
  PID:2220
- C:\Windows\system32\powercfg.exe
  powercfg /setACvalueindex scheme_current SUB_PROCESSOR SYSCOOLPOL 1
  2⤵
  - Power Settings
  - Suspicious use of AdjustPrivilegeToken
  PID:4888
- C:\Windows\system32\powercfg.exe
  powercfg /setDCvalueindex scheme_current SUB_PROCESSOR SYSCOOLPOL 1
  2⤵
  - Power Settings
  - Suspicious use of AdjustPrivilegeToken
  PID:2412
- C:\Windows\system32\powercfg.exe
  powercfg /setactive SCHEME_CURRENT
  2⤵
  - Power Settings
  - Suspicious use of AdjustPrivilegeToken
  PID:624
- C:\Windows\system32\powercfg.exe
  powercfg -setacvalueindex scheme_current sub_processor PROCTHROTTLEMAX 100
  2⤵
  - Power Settings
  - Suspicious use of AdjustPrivilegeToken
  PID:788
- C:\Windows\system32\powercfg.exe
  powercfg -setdcvalueindex scheme_current sub_processor PROCTHROTTLEMAX 100
  2⤵
  - Power Settings
  - Suspicious use of AdjustPrivilegeToken
  PID:3608
- C:\Windows\system32\powercfg.exe
  powercfg -setacvalueindex scheme_current sub_processor PROCTHROTTLEMIN 100
  2⤵
  - Power Settings
  - Suspicious use of AdjustPrivilegeToken
  PID:3036
- C:\Windows\system32\powercfg.exe
  powercfg -setdcvalueindex scheme_current sub_processor PROCTHROTTLEMIN 100
  2⤵
  - Power Settings
  - Suspicious use of AdjustPrivilegeToken
  PID:1932
- C:\Windows\system32\powercfg.exe
  powercfg -setactive scheme_current
  2⤵
  - Power Settings
  - Suspicious use of AdjustPrivilegeToken
  PID:964
- C:\Windows\system32\powercfg.exe
  powercfg -setacvalueindex scheme_current sub_processor CPMAXCORES 100
  2⤵
  - Power Settings
  - Suspicious use of AdjustPrivilegeToken
  PID:4796
- C:\Windows\system32\powercfg.exe
  powercfg -setdcvalueindex scheme_current sub_processor CPMAXCORES 100
  2⤵
  - Power Settings
  - Suspicious use of AdjustPrivilegeToken
  PID:1064
- C:\Windows\system32\powercfg.exe
  powercfg -setacvalueindex scheme_current sub_processor CPMINCORES 100
  2⤵
  - Power Settings
  - Suspicious use of AdjustPrivilegeToken
  PID:2096
- C:\Windows\system32\powercfg.exe
  powercfg -setdcvalueindex scheme_current sub_processor CPMINCORES 100
  2⤵
  - Power Settings
  - Suspicious use of AdjustPrivilegeToken
  PID:2932
- C:\Windows\system32\powercfg.exe
  powercfg -setactive scheme_current
  2⤵
  - Power Settings
  - Suspicious use of AdjustPrivilegeToken
  PID:5096
- C:\Windows\system32\reg.exe
  Reg.exe add "HKLM\SYSTEM\CurrentControlSet\Control\Power\PowerSettings\54533251-82be-4824-96c1-47b60b740d00\be337238-0d82-4146-a960-4f3749d470c7" /v "Attributes" /t REG_DWORD /d 2 /f
  2⤵
  PID:3100
- C:\Windows\system32\powercfg.exe
  powercfg -setacvalueindex scheme_current sub_processor PERFBOOSTMODE 0
  2⤵
  - Power Settings
  - Suspicious use of AdjustPrivilegeToken
  PID:4912
- C:\Windows\system32\powercfg.exe
  powercfg -setdcvalueindex scheme_current sub_processor PERFBOOSTMODE 0
  2⤵
  - Power Settings
  - Suspicious use of AdjustPrivilegeToken
  PID:3324
- C:\Windows\system32\powercfg.exe
  powercfg -setactive scheme_current
  2⤵
  - Power Settings
  - Suspicious use of AdjustPrivilegeToken
  PID:4984
- C:\Windows\system32\reg.exe
  Reg.exe add "HKCU\Control Panel\Desktop" /v "MenuShowDelay" /t REG_SZ /d "0" /f
  2⤵
  PID:2456
- C:\Windows\system32\reg.exe
  Reg.exe add "HKCU\Control Panel\Mouse" /v "MouseHoverTime" /t REG_SZ /d "0" /f
  2⤵
  PID:2644
- C:\Windows\system32\reg.exe
  Reg.exe add "HKLM\SYSTEM\CurrentControlSet\Control\Session Manager\Memory Management" /v "LargeSystemCache" /t REG_DWORD /d 1 /f
  2⤵
  PID:2180
- C:\Windows\system32\reg.exe
  Reg.exe add "HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\VisualEffects" /v "VisualFXSetting" /t REG_DWORD /d 2 /f
  2⤵
  PID:4360
- C:\Windows\system32\sc.exe
  sc config "DiagTrack" start= disabled
  2⤵
  - Launches sc.exe
  PID:3392
- C:\Windows\system32\sc.exe
  sc config "SysMain" start= disabled
  2⤵
  - Launches sc.exe
  PID:5024
- C:\Windows\system32\sc.exe
  sc config "WSearch" start= disabled
  2⤵
  - Launches sc.exe
  PID:3456
- C:\Windows\system32\sc.exe
  sc config "Fax" start= disabled
  2⤵
  - Launches sc.exe
  PID:4060
- C:\Windows\system32\sc.exe
  sc config "TabletInputService" start= disabled
  2⤵
  - Launches sc.exe
  PID:1364
- C:\Windows\system32\sc.exe
  sc stop "DiagTrack"
  2⤵
  - Launches sc.exe
  PID:2280
- C:\Windows\system32\sc.exe
  sc stop "SysMain"
  2⤵
  - Launches sc.exe
  PID:4160
- C:\Windows\system32\sc.exe
  sc stop "WSearch"
  2⤵
  - Launches sc.exe
  PID:3276
- C:\Windows\system32\sc.exe
  sc stop "Fax"
  2⤵
  - Launches sc.exe
  PID:1376
- C:\Windows\system32\sc.exe
  sc stop "TabletInputService"
  2⤵
  - Launches sc.exe
  PID:1448
- C:\Windows\system32\fsutil.exe
  fsutil behavior set DisableDeleteNotify 0
  2⤵
  PID:4384
- C:\Windows\system32\reg.exe
  Reg.exe add "HKLM\SYSTEM\CurrentControlSet\Control\FileSystem" /v "NtfsDisable8dot3NameCreation" /t REG_DWORD /d 1 /f
  2⤵
  PID:4432
- C:\Windows\system32\reg.exe
  Reg.exe add "HKLM\SYSTEM\CurrentControlSet\Control\FileSystem" /v "NtfsMemoryUsage" /t REG_DWORD /d 2 /f
  2⤵
  PID:532
- C:\Windows\system32\reg.exe
  Reg.exe add "HKLM\SYSTEM\CurrentControlSet\Control\Session Manager\Memory Management" /v "ClearPageFileAtShutdown" /t REG_DWORD /d 1 /f
  2⤵
  PID:608
- C:\Windows\system32\reg.exe
  Reg.exe add "HKLM\SYSTEM\CurrentControlSet\Control\Session Manager\Memory Management" /v "DisablePagingExecutive" /t REG_DWORD /d 1 /f
  2⤵
  PID:3448
- C:\Windows\system32\reg.exe
  Reg.exe add "HKLM\SYSTEM\CurrentControlSet\Control\Session Manager\Memory Management" /v "LargeSystemCache" /t REG_DWORD /d 1 /f
  2⤵
  PID:380
- C:\Windows\system32\reg.exe
  Reg.exe add "HKLM\SYSTEM\CurrentControlSet\Control\Session Manager\Memory Management" /v "SecondLevelDataCache" /t REG_DWORD /d 512 /f
  2⤵
  PID:4000
- C:\Windows\system32\timeout.exe
  timeout /t 1 /nobreak
  2⤵
  - Delays execution with timeout.exe
  PID:932
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c "prompt $H &echo on &for %B in (1) do rem"
  2⤵
  PID:4396