6722db26bb76c7b4f3ed4824f792005c8633dda2987f78440bf6be3bdea4807c

Analysis

max time kernel
1525s
max time network
1528s
platform
windows11-21h2_x64
resource
win11-20241007-en
resource tags

arch:x64arch:x86image:win11-20241007-enlocale:en-usos:windows11-21h2-x64system
submitted
03-11-2024 00:53

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

SHADOW BP + HAX 3.4/SETUP/Kill_Gameloop.bat
Size

507B
MD5

9b1141afa4c3fa4711363995f50293f9
SHA1

a42e270c2c3d42626607ede069ddbc88a62efee0
SHA256

3fc915854738ccfa1e5340a353fb11627c9a02fe956dcf29807b8e7b2dc4550c
SHA512

d57915a1df776ea0d3b1a6d4e285387d396f0c232f810a8b8be9c51737a0c90a2dac7b22224327fc60470b5d435f060f3bceacff75b1aadbf07167bdd130b198

Score

1^/10

Malware Config

Signatures

Kills process with taskkill 12 IoCs

evasion

pid	Process
5016	taskkill.exe
236	taskkill.exe
2336	taskkill.exe
2992	taskkill.exe
3144	taskkill.exe
2784	taskkill.exe
1016	taskkill.exe
1324	taskkill.exe
4748	taskkill.exe
3140	taskkill.exe
2996	taskkill.exe
3380	taskkill.exe

Runs net.exe

Suspicious use of AdjustPrivilegeToken 12 IoCs

description	pid	Process
Token: SeDebugPrivilege	1016	taskkill.exe
Token: SeDebugPrivilege	3380	taskkill.exe
Token: SeDebugPrivilege	1324	taskkill.exe
Token: SeDebugPrivilege	4748	taskkill.exe
Token: SeDebugPrivilege	5016	taskkill.exe
Token: SeDebugPrivilege	236	taskkill.exe
Token: SeDebugPrivilege	2336	taskkill.exe
Token: SeDebugPrivilege	2992	taskkill.exe
Token: SeDebugPrivilege	3140	taskkill.exe
Token: SeDebugPrivilege	3144	taskkill.exe
Token: SeDebugPrivilege	2784	taskkill.exe
Token: SeDebugPrivilege	2996	taskkill.exe

Suspicious use of WriteProcessMemory 40 IoCs

description	pid	Process	procid_target
PID 2124 wrote to memory of 2840	2124	cmd.exe	82
PID 2124 wrote to memory of 2840	2124	cmd.exe	82
PID 2840 wrote to memory of 3776	2840	net.exe	83
PID 2840 wrote to memory of 3776	2840	net.exe	83
PID 2124 wrote to memory of 3204	2124	cmd.exe	84
PID 2124 wrote to memory of 3204	2124	cmd.exe	84
PID 3204 wrote to memory of 3372	3204	net.exe	85
PID 3204 wrote to memory of 3372	3204	net.exe	85
PID 2124 wrote to memory of 1016	2124	cmd.exe	86
PID 2124 wrote to memory of 1016	2124	cmd.exe	86
PID 2124 wrote to memory of 3380	2124	cmd.exe	88
PID 2124 wrote to memory of 3380	2124	cmd.exe	88
PID 2124 wrote to memory of 1324	2124	cmd.exe	89
PID 2124 wrote to memory of 1324	2124	cmd.exe	89
PID 2124 wrote to memory of 4748	2124	cmd.exe	90
PID 2124 wrote to memory of 4748	2124	cmd.exe	90
PID 2124 wrote to memory of 5016	2124	cmd.exe	91
PID 2124 wrote to memory of 5016	2124	cmd.exe	91
PID 2124 wrote to memory of 236	2124	cmd.exe	92
PID 2124 wrote to memory of 236	2124	cmd.exe	92
PID 2124 wrote to memory of 2336	2124	cmd.exe	94
PID 2124 wrote to memory of 2336	2124	cmd.exe	94
PID 2124 wrote to memory of 2992	2124	cmd.exe	95
PID 2124 wrote to memory of 2992	2124	cmd.exe	95
PID 2124 wrote to memory of 3140	2124	cmd.exe	96
PID 2124 wrote to memory of 3140	2124	cmd.exe	96
PID 2124 wrote to memory of 3144	2124	cmd.exe	97
PID 2124 wrote to memory of 3144	2124	cmd.exe	97
PID 2124 wrote to memory of 2784	2124	cmd.exe	98
PID 2124 wrote to memory of 2784	2124	cmd.exe	98
PID 2124 wrote to memory of 2996	2124	cmd.exe	99
PID 2124 wrote to memory of 2996	2124	cmd.exe	99
PID 2124 wrote to memory of 2448	2124	cmd.exe	100
PID 2124 wrote to memory of 2448	2124	cmd.exe	100
PID 2448 wrote to memory of 4956	2448	net.exe	101
PID 2448 wrote to memory of 4956	2448	net.exe	101
PID 2124 wrote to memory of 740	2124	cmd.exe	102
PID 2124 wrote to memory of 740	2124	cmd.exe	102
PID 740 wrote to memory of 1524	740	net.exe	103
PID 740 wrote to memory of 1524	740	net.exe	103

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\SHADOW BP + HAX 3.4\SETUP\Kill_Gameloop.bat"
1⤵
- Suspicious use of WriteProcessMemory
PID:2124
- C:\Windows\system32\net.exe
  net stop aow_drv
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2840
- - C:\Windows\system32\net1.exe
    C:\Windows\system32\net1 stop aow_drv
    3⤵
    PID:3776
- C:\Windows\system32\net.exe
  net stop Tensafe
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:3204
- - C:\Windows\system32\net1.exe
    C:\Windows\system32\net1 stop Tensafe
    3⤵
    PID:3372
- C:\Windows\system32\taskkill.exe
  taskkill /f /im appmarket.exe
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:1016
- C:\Windows\system32\taskkill.exe
  taskkill /f /im androidemulator.exe
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:3380
- C:\Windows\system32\taskkill.exe
  taskkill /f /im aow_exe.exe
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:1324
- C:\Windows\system32\taskkill.exe
  taskkill /f /im QMEmulatorService.exe
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:4748
- C:\Windows\system32\taskkill.exe
  taskkill /f /im RuntimeBroker.exe
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:5016
- C:\Windows\system32\taskkill.exe
  taskkill /f /im adb.exe
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:236
- C:\Windows\system32\taskkill.exe
  taskkill /f /im GameLoader.exe
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:2336
- C:\Windows\system32\taskkill.exe
  taskkill /f /im TSettingCenter.exe
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:2992
- C:\Windows\system32\taskkill.exe
  taskkill /f /im syzs_dl_svr.exe
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:3140
- C:\Windows\system32\taskkill.exe
  taskkill /f /im AndroidEmulator.exe
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:3144
- C:\Windows\system32\taskkill.exe
  taskkill /f /im AndroidEmulatorEn.exe
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:2784
- C:\Windows\system32\taskkill.exe
  taskkill /f /im AndroidEmulatorEx.exe
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:2996
- C:\Windows\system32\net.exe
  net stop aow_drv
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2448
- - C:\Windows\system32\net1.exe
    C:\Windows\system32\net1 stop aow_drv
    3⤵
    PID:4956
- C:\Windows\system32\net.exe
  net stop Tensafe
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:740
- - C:\Windows\system32\net1.exe
    C:\Windows\system32\net1 stop Tensafe
    3⤵
    PID:1524

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads