c4d74e49c44c880ec1b4cdede24423872f931e617b33d6bdba31e0534a12b809

Resubmissions

09/11/2024, 22:49

09/11/2024, 22:47

09/11/2024, 22:46

09/11/2024, 22:44

07/11/2024, 16:00

10/02/2024, 17:17

max time kernel
91s
max time network
138s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
09/11/2024, 22:44

Target

ggpermV3/Final_Cleaner.bat
Size

107KB
MD5

98f1a0eebcb5f4798662a40323b05a7e
SHA1

068e288005c04b8d859c44d3767613a8036bdb11
SHA256

00023ce602db623e47de1029595339eec4ee5019c6017236c9b721cac0ae4032
SHA512

6cfda16ce56b1173b91bd86c0f977f022a0b01a77142a15f66d865ee3f00ffee6aa2df7571edcccac41f7d680a9c4c536991abd91e86a00b083b8f9f37a39cf7
SSDEEP

768:S/KZzmezF/svUsfg8gVhCBL1oPYdxCA1n5xpoL8oPlRPrPEPupL5LvLpLjLgwJyo:Kg8gUDRnvplQL5LvLpLjLnn

Score

1^/10

Kills process with taskkill 5 IoCs

evasion

Suspicious use of AdjustPrivilegeToken 5 IoCs

Suspicious use of WriteProcessMemory 10 IoCs

description	pid	Process	procid_target
PID 3660 wrote to memory of 3968	3660	cmd.exe	85
PID 3660 wrote to memory of 3968	3660	cmd.exe	85
PID 3660 wrote to memory of 3020	3660	cmd.exe	87
PID 3660 wrote to memory of 3020	3660	cmd.exe	87
PID 3660 wrote to memory of 3716	3660	cmd.exe	88
PID 3660 wrote to memory of 3716	3660	cmd.exe	88
PID 3660 wrote to memory of 2868	3660	cmd.exe	89
PID 3660 wrote to memory of 2868	3660	cmd.exe	89
PID 3660 wrote to memory of 2760	3660	cmd.exe	90
PID 3660 wrote to memory of 2760	3660	cmd.exe	90

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\ggpermV3\Final_Cleaner.bat"
1⤵
- Suspicious use of WriteProcessMemory
PID:3660
- C:\Windows\system32\taskkill.exe
  taskkill /f /im FortniteClient-Win64-Shipping_EAC.exe
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:3968
- C:\Windows\system32\taskkill.exe
  taskkill /f /im FortniteClient-Win64-Shipping.exe
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:3020
- C:\Windows\system32\taskkill.exe
  taskkill /f /im FortniteClient-Win64-Shipping_BE.exe
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:3716
- C:\Windows\system32\taskkill.exe
  taskkill /f /im FortniteLauncher.exe
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:2868
- C:\Windows\system32\taskkill.exe
  taskkill /f /im EpicGamesLauncher.exe
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:2760