c4d74e49c44c880ec1b4cdede24423872f931e617b33d6bdba31e0534a12b809

Resubmissions

09-11-2024 22:49

09-11-2024 22:47

09-11-2024 22:46

09-11-2024 22:44

07-11-2024 16:00

10-02-2024 17:17

max time kernel
91s
max time network
19s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
09-11-2024 22:47

Target

ggpermV3/Final_Cleaner.bat
Size

107KB
MD5

98f1a0eebcb5f4798662a40323b05a7e
SHA1

068e288005c04b8d859c44d3767613a8036bdb11
SHA256

00023ce602db623e47de1029595339eec4ee5019c6017236c9b721cac0ae4032
SHA512

6cfda16ce56b1173b91bd86c0f977f022a0b01a77142a15f66d865ee3f00ffee6aa2df7571edcccac41f7d680a9c4c536991abd91e86a00b083b8f9f37a39cf7
SSDEEP

768:S/KZzmezF/svUsfg8gVhCBL1oPYdxCA1n5xpoL8oPlRPrPEPupL5LvLpLjLgwJyo:Kg8gUDRnvplQL5LvLpLjLnn

Score

1^/10

Kills process with taskkill 5 IoCs

evasion

Suspicious use of AdjustPrivilegeToken 5 IoCs

Suspicious use of WriteProcessMemory 15 IoCs

description	pid	Process	procid_target
PID 1868 wrote to memory of 2188	1868	cmd.exe	32
PID 1868 wrote to memory of 2188	1868	cmd.exe	32
PID 1868 wrote to memory of 2188	1868	cmd.exe	32
PID 1868 wrote to memory of 3068	1868	cmd.exe	34
PID 1868 wrote to memory of 3068	1868	cmd.exe	34
PID 1868 wrote to memory of 3068	1868	cmd.exe	34
PID 1868 wrote to memory of 2140	1868	cmd.exe	35
PID 1868 wrote to memory of 2140	1868	cmd.exe	35
PID 1868 wrote to memory of 2140	1868	cmd.exe	35
PID 1868 wrote to memory of 2640	1868	cmd.exe	36
PID 1868 wrote to memory of 2640	1868	cmd.exe	36
PID 1868 wrote to memory of 2640	1868	cmd.exe	36
PID 1868 wrote to memory of 2736	1868	cmd.exe	37
PID 1868 wrote to memory of 2736	1868	cmd.exe	37
PID 1868 wrote to memory of 2736	1868	cmd.exe	37

C:\Windows\system32\cmd.exe
cmd /c "C:\Users\Admin\AppData\Local\Temp\ggpermV3\Final_Cleaner.bat"
1⤵
- Suspicious use of WriteProcessMemory
PID:1868
- C:\Windows\system32\taskkill.exe
  taskkill /f /im FortniteClient-Win64-Shipping_EAC.exe
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:2188
- C:\Windows\system32\taskkill.exe
  taskkill /f /im FortniteClient-Win64-Shipping.exe
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:3068
- C:\Windows\system32\taskkill.exe
  taskkill /f /im FortniteClient-Win64-Shipping_BE.exe
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:2140
- C:\Windows\system32\taskkill.exe
  taskkill /f /im FortniteLauncher.exe
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:2640
- C:\Windows\system32\taskkill.exe
  taskkill /f /im EpicGamesLauncher.exe
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:2736