becbc54754933c1ed670f50a19fbf6debab9257cbeb7a7afdca4d41d449ddfab

Analysis

max time kernel
92s
max time network
97s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
05/10/2024, 09:52

Target

release/kill_Gameloop.bat
Size

213B
MD5

545b6b1b5147376aec1bea5b35be2d8e
SHA1

4ffe5e562a03fc9505c55d674ffb2a0d1ad8071d
SHA256

66fb3509057f34ec750b992fd9ceaf7cdb0df9704f46c8c76774d259808d6692
SHA512

2f230e67e51ff958b0c292d5ad2a823fa6c979fb32a25681bcc93506a5db34b07b55d2b164c8758cfdc99f26ed6ddf5f1d34a7204b273585ee7aa35e5b47a4c6

Score

8^/10

evasion execution

Stops running service(s) 4 TTPs
evasion execution

Windows Service
T1543.003

Impair Defenses
T1562

Service Stop
T1489

Service Execution
T1569.002

Launches sc.exe 1 IoCs

Sc.exe is a Windows utlilty to control services on the system.

pid	Process
3344	sc.exe

Delays execution with timeout.exe 1 IoCs

evasion

pid	Process
1064	timeout.exe

Kills process with taskkill 3 IoCs

evasion

Suspicious use of AdjustPrivilegeToken 3 IoCs

Suspicious use of WriteProcessMemory 10 IoCs

description	pid	Process	procid_target
PID 4868 wrote to memory of 520	4868	cmd.exe	83
PID 4868 wrote to memory of 520	4868	cmd.exe	83
PID 4868 wrote to memory of 5032	4868	cmd.exe	85
PID 4868 wrote to memory of 5032	4868	cmd.exe	85
PID 4868 wrote to memory of 2332	4868	cmd.exe	86
PID 4868 wrote to memory of 2332	4868	cmd.exe	86
PID 4868 wrote to memory of 1064	4868	cmd.exe	87
PID 4868 wrote to memory of 1064	4868	cmd.exe	87
PID 4868 wrote to memory of 3344	4868	cmd.exe	88
PID 4868 wrote to memory of 3344	4868	cmd.exe	88

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\release\kill_Gameloop.bat"
1⤵
- Suspicious use of WriteProcessMemory
PID:4868
- C:\Windows\system32\taskkill.exe
  taskkill /im AndroidEmulatorEn.exe /f
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:520
- C:\Windows\system32\taskkill.exe
  taskkill /im AndroidEmulatorEx.exe /f
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:5032
- C:\Windows\system32\taskkill.exe
  taskkill /im AppMarket.exe /f
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:2332
- C:\Windows\system32\timeout.exe
  timeout /t 3
  2⤵
  - Delays execution with timeout.exe
  PID:1064
- C:\Windows\system32\sc.exe
  sc stop aow_drv
  2⤵
  - Launches sc.exe
  PID:3344