c4d74e49c44c880ec1b4cdede24423872f931e617b33d6bdba31e0534a12b809

Resubmissions

09-11-2024 22:49

09-11-2024 22:47

09-11-2024 22:46

09-11-2024 22:44

07-11-2024 16:00

10-02-2024 17:17

max time kernel
424s
max time network
1148s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
09-11-2024 22:46

Target

ggpermV3/Final_Cleaner.bat
Size

107KB
MD5

98f1a0eebcb5f4798662a40323b05a7e
SHA1

068e288005c04b8d859c44d3767613a8036bdb11
SHA256

00023ce602db623e47de1029595339eec4ee5019c6017236c9b721cac0ae4032
SHA512

6cfda16ce56b1173b91bd86c0f977f022a0b01a77142a15f66d865ee3f00ffee6aa2df7571edcccac41f7d680a9c4c536991abd91e86a00b083b8f9f37a39cf7
SSDEEP

768:S/KZzmezF/svUsfg8gVhCBL1oPYdxCA1n5xpoL8oPlRPrPEPupL5LvLpLjLgwJyo:Kg8gUDRnvplQL5LvLpLjLnn

Score

1^/10

Kills process with taskkill 5 IoCs

evasion

Suspicious use of AdjustPrivilegeToken 5 IoCs

Suspicious use of WriteProcessMemory 10 IoCs

description	pid	Process	procid_target
PID 1948 wrote to memory of 4540	1948	cmd.exe	84
PID 1948 wrote to memory of 4540	1948	cmd.exe	84
PID 1948 wrote to memory of 1056	1948	cmd.exe	86
PID 1948 wrote to memory of 1056	1948	cmd.exe	86
PID 1948 wrote to memory of 1312	1948	cmd.exe	87
PID 1948 wrote to memory of 1312	1948	cmd.exe	87
PID 1948 wrote to memory of 2548	1948	cmd.exe	88
PID 1948 wrote to memory of 2548	1948	cmd.exe	88
PID 1948 wrote to memory of 5072	1948	cmd.exe	89
PID 1948 wrote to memory of 5072	1948	cmd.exe	89

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\ggpermV3\Final_Cleaner.bat"
1⤵
- Suspicious use of WriteProcessMemory
PID:1948
- C:\Windows\system32\taskkill.exe
  taskkill /f /im FortniteClient-Win64-Shipping_EAC.exe
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:4540
- C:\Windows\system32\taskkill.exe
  taskkill /f /im FortniteClient-Win64-Shipping.exe
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:1056
- C:\Windows\system32\taskkill.exe
  taskkill /f /im FortniteClient-Win64-Shipping_BE.exe
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:1312
- C:\Windows\system32\taskkill.exe
  taskkill /f /im FortniteLauncher.exe
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:2548
- C:\Windows\system32\taskkill.exe
  taskkill /f /im EpicGamesLauncher.exe
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:5072