Analysis

  • max time kernel
    15s
  • max time network
    20s
  • platform
    windows7_x64
  • resource
    win7-20241010-en
  • resource tags

    arch:x64arch:x86image:win7-20241010-enlocale:en-usos:windows7-x64system
  • submitted
    27/10/2024, 10:44

General

  • Target

    WinS/wd.bat

  • Size

    383B

  • MD5

    479988fe0741ba53d6682562377fbee6

  • SHA1

    b56e82fe314d82adbb8f50c1669eda87e4a6a7e1

  • SHA256

    490c8ef0d7aa7daa4255ff0792e4ba8d5edad5e2f8ab032da1ac77019a207146

  • SHA512

    5fe6e34f13cb63dc9ceee13546d02b2d0c024668a30d35047fa44791481e8845c9fa4e05da64f7b5724ed8ac8b15f4e48c6f7c14b4e93dea6d1e690bc9cde0c2

Score
8/10

Malware Config

Signatures

  • Command and Scripting Interpreter: PowerShell 1 TTPs 6 IoCs

    Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

  • Suspicious behavior: EnumeratesProcesses 6 IoCs
  • Suspicious use of AdjustPrivilegeToken 6 IoCs
  • Suspicious use of WriteProcessMemory 18 IoCs

Processes

  • C:\Windows\system32\cmd.exe
    cmd /c "C:\Users\Admin\AppData\Local\Temp\WinS\wd.bat"
    1⤵
    • Suspicious use of WriteProcessMemory
    PID:2476
    • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell.exe Add-MpPreference -ExclusionPath C:\Windows\WinS
      2⤵
      • Command and Scripting Interpreter: PowerShell
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      PID:2824
    • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell.exe Add-MpPreference -ExclusionPath C:\
      2⤵
      • Command and Scripting Interpreter: PowerShell
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      PID:3064
    • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell.exe Add-MpPreference -ExclusionExtension ".exe"
      2⤵
      • Command and Scripting Interpreter: PowerShell
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      PID:2920
    • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell.exe Add-MpPreference -ExclusionExtension ".zip"
      2⤵
      • Command and Scripting Interpreter: PowerShell
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      PID:2844
    • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell.exe Add-MpPreference -ExclusionExtension ".bat"
      2⤵
      • Command and Scripting Interpreter: PowerShell
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      PID:1488
    • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell.exe Add-MpPreference -ExclusionExtension ".sys"
      2⤵
      • Command and Scripting Interpreter: PowerShell
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      PID:2128

Network

        MITRE ATT&CK Enterprise v15

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        • C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\590aee7bdd69b59b.customDestinations-ms

          Filesize

          7KB

          MD5

          630498e6fc5acf3dd937820ee729ca53

          SHA1

          7fac3e270fcd76055dba84f68d02132d94315d0f

          SHA256

          45e5abf914c234adb64984f4b584728e328fe20a45f71d436dfec72aaae5045c

          SHA512

          a7e0e03f0c610a84da9b575051b467f1df2202363634accfc6811e71db4c2b80547c8d951f089d27772ed8c862343f7fc99ad7cffcced7abd317ec85f845870c

        • memory/2824-7-0x000007FEF5AC0000-0x000007FEF645D000-memory.dmp

          Filesize

          9.6MB

        • memory/2824-4-0x000007FEF5D7E000-0x000007FEF5D7F000-memory.dmp

          Filesize

          4KB

        • memory/2824-8-0x000007FEF5AC0000-0x000007FEF645D000-memory.dmp

          Filesize

          9.6MB

        • memory/2824-9-0x000007FEF5AC0000-0x000007FEF645D000-memory.dmp

          Filesize

          9.6MB

        • memory/2824-10-0x000007FEF5AC0000-0x000007FEF645D000-memory.dmp

          Filesize

          9.6MB

        • memory/2824-11-0x000007FEF5AC0000-0x000007FEF645D000-memory.dmp

          Filesize

          9.6MB

        • memory/2824-12-0x000007FEF5AC0000-0x000007FEF645D000-memory.dmp

          Filesize

          9.6MB

        • memory/2824-6-0x0000000001F50000-0x0000000001F58000-memory.dmp

          Filesize

          32KB

        • memory/2824-5-0x000000001B290000-0x000000001B572000-memory.dmp

          Filesize

          2.9MB

        • memory/3064-18-0x000000001B370000-0x000000001B652000-memory.dmp

          Filesize

          2.9MB

        • memory/3064-19-0x0000000001F50000-0x0000000001F58000-memory.dmp

          Filesize

          32KB