c4d74e49c44c880ec1b4cdede24423872f931e617b33d6bdba31e0534a12b809

Resubmissions

09/11/2024, 22:49

09/11/2024, 22:47

09/11/2024, 22:46

09/11/2024, 22:44

07/11/2024, 16:00

10/02/2024, 17:17

max time kernel
108s
max time network
137s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
07/11/2024, 16:00

Target

ggpermV3/Final_Cleaner.bat
Size

107KB
MD5

98f1a0eebcb5f4798662a40323b05a7e
SHA1

068e288005c04b8d859c44d3767613a8036bdb11
SHA256

00023ce602db623e47de1029595339eec4ee5019c6017236c9b721cac0ae4032
SHA512

6cfda16ce56b1173b91bd86c0f977f022a0b01a77142a15f66d865ee3f00ffee6aa2df7571edcccac41f7d680a9c4c536991abd91e86a00b083b8f9f37a39cf7
SSDEEP

768:S/KZzmezF/svUsfg8gVhCBL1oPYdxCA1n5xpoL8oPlRPrPEPupL5LvLpLjLgwJyo:Kg8gUDRnvplQL5LvLpLjLnn

Score

1^/10

Kills process with taskkill 5 IoCs

evasion

Suspicious use of AdjustPrivilegeToken 5 IoCs

Suspicious use of WriteProcessMemory 14 IoCs

description	pid	Process	procid_target
PID 4464 wrote to memory of 1260	4464	cmd.exe	85
PID 4464 wrote to memory of 1260	4464	cmd.exe	85
PID 4464 wrote to memory of 3704	4464	cmd.exe	87
PID 4464 wrote to memory of 3704	4464	cmd.exe	87
PID 4464 wrote to memory of 1708	4464	cmd.exe	88
PID 4464 wrote to memory of 1708	4464	cmd.exe	88
PID 4464 wrote to memory of 1500	4464	cmd.exe	89
PID 4464 wrote to memory of 1500	4464	cmd.exe	89
PID 4464 wrote to memory of 4876	4464	cmd.exe	90
PID 4464 wrote to memory of 4876	4464	cmd.exe	90
PID 4464 wrote to memory of 4576	4464	cmd.exe	109
PID 4464 wrote to memory of 4576	4464	cmd.exe	109
PID 4576 wrote to memory of 3020	4576	cmd.exe	110
PID 4576 wrote to memory of 3020	4576	cmd.exe	110

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\ggpermV3\Final_Cleaner.bat"
1⤵
- Suspicious use of WriteProcessMemory
PID:4464
- C:\Windows\system32\taskkill.exe
  taskkill /f /im FortniteClient-Win64-Shipping_EAC.exe
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:1260
- C:\Windows\system32\taskkill.exe
  taskkill /f /im FortniteClient-Win64-Shipping.exe
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:3704
- C:\Windows\system32\taskkill.exe
  taskkill /f /im FortniteClient-Win64-Shipping_BE.exe
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:1708
- C:\Windows\system32\taskkill.exe
  taskkill /f /im FortniteLauncher.exe
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:1500
- C:\Windows\system32\taskkill.exe
  taskkill /f /im EpicGamesLauncher.exe
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:4876
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c findstr /b ::: "C:\Users\Admin\AppData\Local\Temp\ggpermV3\Final_Cleaner.bat"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:4576
- - C:\Windows\system32\findstr.exe
    findstr /b ::: "C:\Users\Admin\AppData\Local\Temp\ggpermV3\Final_Cleaner.bat"
    3⤵
    PID:3020