c4d74e49c44c880ec1b4cdede24423872f931e617b33d6bdba31e0534a12b809

Resubmissions

09/11/2024, 22:49

09/11/2024, 22:47

09/11/2024, 22:46

09/11/2024, 22:44

07/11/2024, 16:00

28/02/2024, 21:26

10/02/2024, 17:17

max time kernel
424s
max time network
1148s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
09/11/2024, 22:46

Target
ggpermV3/Final_Cleaner.bat
Size 107KB
Sample241109-2p2fvstfqj
SHA256 00023ce602db623e47de1029595339eec4ee5019c6017236c9b721cac0ae4032
MD5 98f1a0eebcb5f4798662a40323b05a7e
SHA1 068e288005c04b8d859c44d3767613a8036bdb11
SHA512 6cfda16ce56b1173b91bd86c0f977f022a0b01a77142a15f66d865ee3f00ffee6aa2df7571edcccac41f7d680a9c4c536991abd91e86a00b083b8f9f37a39cf7
SSDEEP 768:S/KZzmezF/svUsfg8gVhCBL1oPYdxCA1n5xpoL8oPlRPrPEPupL5LvLpLjLgwJyo:Kg8gUDRnvplQL5LvLpLjLnn
MD5 SHA1 SHA512 SSDEEP

Score

1^/10

Kills process with taskkill 5 IoCs

evasion

Suspicious use of AdjustPrivilegeToken 5 IoCs

Suspicious use of WriteProcessMemory 10 IoCs

description	pid	Process	procid_target
PID 1948 wrote to memory of 4540	1948	cmd.exe	84
PID 1948 wrote to memory of 4540	1948	cmd.exe	84
PID 1948 wrote to memory of 1056	1948	cmd.exe	86
PID 1948 wrote to memory of 1056	1948	cmd.exe	86
PID 1948 wrote to memory of 1312	1948	cmd.exe	87
PID 1948 wrote to memory of 1312	1948	cmd.exe	87
PID 1948 wrote to memory of 2548	1948	cmd.exe	88
PID 1948 wrote to memory of 2548	1948	cmd.exe	88
PID 1948 wrote to memory of 5072	1948	cmd.exe	89
PID 1948 wrote to memory of 5072	1948	cmd.exe	89

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\ggpermV3\Final_Cleaner.bat"
1⤵
- Suspicious use of WriteProcessMemory
PID:1948
- C:\Windows\system32\taskkill.exe
  taskkill /f /im FortniteClient-Win64-Shipping_EAC.exe
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:4540
- C:\Windows\system32\taskkill.exe
  taskkill /f /im FortniteClient-Win64-Shipping.exe
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:1056
- C:\Windows\system32\taskkill.exe
  taskkill /f /im FortniteClient-Win64-Shipping_BE.exe
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:1312
- C:\Windows\system32\taskkill.exe
  taskkill /f /im FortniteLauncher.exe
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:2548
- C:\Windows\system32\taskkill.exe
  taskkill /f /im EpicGamesLauncher.exe
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:5072