d3a307d6c9237b888e40f7ed3a3b590eefc1f9f9739740b03de99c1da56753c2

Analysis

max time kernel
147s
max time network
151s
platform
windows11-21h2_x64
resource
win11-20241007-en
resource tags

arch:x64arch:x86image:win11-20241007-enlocale:en-usos:windows11-21h2-x64system
submitted
21/11/2024, 00:32

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

input lag and system config/PERFORMER by f4fix.bat
Size

11KB
MD5

dcbb5607dd7def7f8f498b2e0f608cd2
SHA1

ec69ab76abc84fd81f22dc60329e4a1bb94f50f3
SHA256

9d3b49d6b29d680cc49579685c8bcb062f9acdcfdd822c4ae3f29fdc9c31504e
SHA512

c64256f86d1e9684715649e7c0f8f7fc5136b34c70276ca509385d5b0dee3b4d2bb3363d2c041633aeae80ccb0b63b6a36ee4529d46f73b8b0d46a0d536a65ad
SSDEEP

96:/2AUMT2WzMTJVxZzVqL3lzjFzMTyh55UERdmUcB:/JBT2WQTJe7vQTs+

Score

10^/10

discovery evasion execution

Malware Config

Signatures

Disables service(s) 3 TTPs
evasion execution

Windows Service
T1543.003

Service Stop
T1489

Service Execution
T1569.002

Launches sc.exe 11 IoCs

Sc.exe is a Windows utlilty to control services on the system.

pid	Process
2644	sc.exe
2380	sc.exe
4176	sc.exe
412	sc.exe
2564	sc.exe
4200	sc.exe
800	sc.exe
5016	sc.exe
4776	sc.exe
3548	sc.exe
1208	sc.exe

System Network Configuration Discovery: Internet Connection Discovery 1 TTPs 28 IoCs

Adversaries may check for Internet connectivity on compromised systems.

discovery

Internet Connection Discovery

T1016.001

pid	Process
1652	PING.EXE
4492	PING.EXE
1632	PING.EXE
872	PING.EXE
1156	PING.EXE
1416	PING.EXE
2744	PING.EXE
4020	PING.EXE
2620	PING.EXE
2924	PING.EXE
3184	PING.EXE
772	PING.EXE
1856	PING.EXE
2272	PING.EXE
4060	PING.EXE
3728	PING.EXE
3036	PING.EXE
3540	PING.EXE
3432	PING.EXE
496	PING.EXE
4716	PING.EXE
2088	PING.EXE
1772	PING.EXE
4660	PING.EXE
4256	PING.EXE
2128	PING.EXE
2916	PING.EXE
3308	PING.EXE

Runs net.exe

Runs ping.exe 1 TTPs 28 IoCs

Remote System Discovery

T1018

pid	Process
2924	PING.EXE
1156	PING.EXE
4060	PING.EXE
1632	PING.EXE
2744	PING.EXE
4020	PING.EXE
2088	PING.EXE
4256	PING.EXE
496	PING.EXE
4660	PING.EXE
1652	PING.EXE
2272	PING.EXE
4492	PING.EXE
2916	PING.EXE
3036	PING.EXE
1416	PING.EXE
1856	PING.EXE
2128	PING.EXE
872	PING.EXE
3540	PING.EXE
2620	PING.EXE
772	PING.EXE
3728	PING.EXE
3308	PING.EXE
1772	PING.EXE
3184	PING.EXE
3432	PING.EXE
4716	PING.EXE

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2616 wrote to memory of 2368	2616	cmd.exe	81
PID 2616 wrote to memory of 2368	2616	cmd.exe	81
PID 2368 wrote to memory of 4360	2368	net.exe	82
PID 2368 wrote to memory of 4360	2368	net.exe	82
PID 2616 wrote to memory of 2380	2616	cmd.exe	83
PID 2616 wrote to memory of 2380	2616	cmd.exe	83
PID 2616 wrote to memory of 2568	2616	cmd.exe	84
PID 2616 wrote to memory of 2568	2616	cmd.exe	84
PID 2568 wrote to memory of 1600	2568	net.exe	85
PID 2568 wrote to memory of 1600	2568	net.exe	85
PID 2616 wrote to memory of 3548	2616	cmd.exe	86
PID 2616 wrote to memory of 3548	2616	cmd.exe	86
PID 2616 wrote to memory of 4364	2616	cmd.exe	87
PID 2616 wrote to memory of 4364	2616	cmd.exe	87
PID 4364 wrote to memory of 4212	4364	net.exe	88
PID 4364 wrote to memory of 4212	4364	net.exe	88
PID 2616 wrote to memory of 4176	2616	cmd.exe	89
PID 2616 wrote to memory of 4176	2616	cmd.exe	89
PID 2616 wrote to memory of 660	2616	cmd.exe	90
PID 2616 wrote to memory of 660	2616	cmd.exe	90
PID 660 wrote to memory of 3836	660	net.exe	91
PID 660 wrote to memory of 3836	660	net.exe	91
PID 2616 wrote to memory of 2644	2616	cmd.exe	92
PID 2616 wrote to memory of 2644	2616	cmd.exe	92
PID 2616 wrote to memory of 1652	2616	cmd.exe	93
PID 2616 wrote to memory of 1652	2616	cmd.exe	93
PID 2616 wrote to memory of 4256	2616	cmd.exe	94
PID 2616 wrote to memory of 4256	2616	cmd.exe	94
PID 2616 wrote to memory of 1856	2616	cmd.exe	95
PID 2616 wrote to memory of 1856	2616	cmd.exe	95
PID 2616 wrote to memory of 2272	2616	cmd.exe	96
PID 2616 wrote to memory of 2272	2616	cmd.exe	96
PID 2616 wrote to memory of 4492	2616	cmd.exe	97
PID 2616 wrote to memory of 4492	2616	cmd.exe	97
PID 2616 wrote to memory of 2128	2616	cmd.exe	98
PID 2616 wrote to memory of 2128	2616	cmd.exe	98
PID 2616 wrote to memory of 4028	2616	cmd.exe	99
PID 2616 wrote to memory of 4028	2616	cmd.exe	99
PID 4028 wrote to memory of 4056	4028	net.exe	100
PID 4028 wrote to memory of 4056	4028	net.exe	100
PID 2616 wrote to memory of 412	2616	cmd.exe	101
PID 2616 wrote to memory of 412	2616	cmd.exe	101
PID 2616 wrote to memory of 4736	2616	cmd.exe	102
PID 2616 wrote to memory of 4736	2616	cmd.exe	102
PID 4736 wrote to memory of 1560	4736	net.exe	103
PID 4736 wrote to memory of 1560	4736	net.exe	103
PID 2616 wrote to memory of 2564	2616	cmd.exe	104
PID 2616 wrote to memory of 2564	2616	cmd.exe	104
PID 2616 wrote to memory of 3728	2616	cmd.exe	105
PID 2616 wrote to memory of 3728	2616	cmd.exe	105
PID 2616 wrote to memory of 1632	2616	cmd.exe	106
PID 2616 wrote to memory of 1632	2616	cmd.exe	106
PID 2616 wrote to memory of 2924	2616	cmd.exe	107
PID 2616 wrote to memory of 2924	2616	cmd.exe	107
PID 2616 wrote to memory of 2744	2616	cmd.exe	108
PID 2616 wrote to memory of 2744	2616	cmd.exe	108
PID 2616 wrote to memory of 2916	2616	cmd.exe	109
PID 2616 wrote to memory of 2916	2616	cmd.exe	109
PID 2616 wrote to memory of 872	2616	cmd.exe	110
PID 2616 wrote to memory of 872	2616	cmd.exe	110
PID 2616 wrote to memory of 3036	2616	cmd.exe	111
PID 2616 wrote to memory of 3036	2616	cmd.exe	111
PID 2616 wrote to memory of 3540	2616	cmd.exe	112
PID 2616 wrote to memory of 3540	2616	cmd.exe	112

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\input lag and system config\PERFORMER by f4fix.bat"
1⤵
- Suspicious use of WriteProcessMemory
PID:2616
- C:\Windows\system32\net.exe
  net stop XboxGipSvc
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2368
- - C:\Windows\system32\net1.exe
    C:\Windows\system32\net1 stop XboxGipSvc
    3⤵
    PID:4360
- C:\Windows\system32\sc.exe
  sc config XboxGipSvc start= Disabled
  2⤵
  - Launches sc.exe
  PID:2380
- C:\Windows\system32\net.exe
  net stop XblAuthManager
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2568
- - C:\Windows\system32\net1.exe
    C:\Windows\system32\net1 stop XblAuthManager
    3⤵
    PID:1600
- C:\Windows\system32\sc.exe
  sc config XblAuthManager start= Disabled
  2⤵
  - Launches sc.exe
  PID:3548
- C:\Windows\system32\net.exe
  net stop XblGameSave
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:4364
- - C:\Windows\system32\net1.exe
    C:\Windows\system32\net1 stop XblGameSave
    3⤵
    PID:4212
- C:\Windows\system32\sc.exe
  sc config XblGameSave start= Disabled
  2⤵
  - Launches sc.exe
  PID:4176
- C:\Windows\system32\net.exe
  net stop XboxNetApiSvc
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:660
- - C:\Windows\system32\net1.exe
    C:\Windows\system32\net1 stop XboxNetApiSvc
    3⤵
    PID:3836
- C:\Windows\system32\sc.exe
  sc config XboxNetApiSvc start= Disabled
  2⤵
  - Launches sc.exe
  PID:2644
- C:\Windows\system32\PING.EXE
  ping localhost -n
  2⤵
  - System Network Configuration Discovery: Internet Connection Discovery
  - Runs ping.exe
  PID:1652
- C:\Windows\system32\PING.EXE
  ping localhost -n 2
  2⤵
  - System Network Configuration Discovery: Internet Connection Discovery
  - Runs ping.exe
  PID:4256
- C:\Windows\system32\PING.EXE
  ping localhost -n 2
  2⤵
  - System Network Configuration Discovery: Internet Connection Discovery
  - Runs ping.exe
  PID:1856
- C:\Windows\system32\PING.EXE
  ping localhost -n 2
  2⤵
  - System Network Configuration Discovery: Internet Connection Discovery
  - Runs ping.exe
  PID:2272
- C:\Windows\system32\PING.EXE
  ping localhost -n 2
  2⤵
  - System Network Configuration Discovery: Internet Connection Discovery
  - Runs ping.exe
  PID:4492
- C:\Windows\system32\PING.EXE
  ping localhost -n 2
  2⤵
  - System Network Configuration Discovery: Internet Connection Discovery
  - Runs ping.exe
  PID:2128
- C:\Windows\system32\net.exe
  net stop wuauserv
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:4028
- - C:\Windows\system32\net1.exe
    C:\Windows\system32\net1 stop wuauserv
    3⤵
    PID:4056
- C:\Windows\system32\sc.exe
  sc config wuauserv start= Disabled
  2⤵
  - Launches sc.exe
  PID:412
- C:\Windows\system32\net.exe
  net stop WaaSMedicSvc
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:4736
- - C:\Windows\system32\net1.exe
    C:\Windows\system32\net1 stop WaaSMedicSvc
    3⤵
    PID:1560
- C:\Windows\system32\sc.exe
  sc config WaaSMedicSvc start= Disabled
  2⤵
  - Launches sc.exe
  PID:2564
- C:\Windows\system32\PING.EXE
  ping localhost -n
  2⤵
  - System Network Configuration Discovery: Internet Connection Discovery
  - Runs ping.exe
  PID:3728
- C:\Windows\system32\PING.EXE
  ping localhost -n 2
  2⤵
  - System Network Configuration Discovery: Internet Connection Discovery
  - Runs ping.exe
  PID:1632
- C:\Windows\system32\PING.EXE
  ping localhost -n 2
  2⤵
  - System Network Configuration Discovery: Internet Connection Discovery
  - Runs ping.exe
  PID:2924
- C:\Windows\system32\PING.EXE
  ping localhost -n 2
  2⤵
  - System Network Configuration Discovery: Internet Connection Discovery
  - Runs ping.exe
  PID:2744
- C:\Windows\system32\PING.EXE
  ping localhost -n 2
  2⤵
  - System Network Configuration Discovery: Internet Connection Discovery
  - Runs ping.exe
  PID:2916
- C:\Windows\system32\PING.EXE
  ping localhost -n 2
  2⤵
  - System Network Configuration Discovery: Internet Connection Discovery
  - Runs ping.exe
  PID:872
- C:\Windows\system32\PING.EXE
  ping localhost -n 2
  2⤵
  - System Network Configuration Discovery: Internet Connection Discovery
  - Runs ping.exe
  PID:3036
- C:\Windows\system32\PING.EXE
  ping localhost -n 5
  2⤵
  - System Network Configuration Discovery: Internet Connection Discovery
  - Runs ping.exe
  PID:3540
- C:\Windows\system32\net.exe
  net stop uhssvc
  2⤵
  PID:960
- - C:\Windows\system32\net1.exe
    C:\Windows\system32\net1 stop uhssvc
    3⤵
    PID:3284
- C:\Windows\system32\sc.exe
  sc config uhssvc start= Disabled
  2⤵
  - Launches sc.exe
  PID:4200
- C:\Windows\system32\net.exe
  net stop SEMgrSvc
  2⤵
  PID:4440
- - C:\Windows\system32\net1.exe
    C:\Windows\system32\net1 stop SEMgrSvc
    3⤵
    PID:3972
- C:\Windows\system32\sc.exe
  sc config SEMgrSvc start= Disabled
  2⤵
  - Launches sc.exe
  PID:800
- C:\Windows\system32\PING.EXE
  ping localhost -n
  2⤵
  - System Network Configuration Discovery: Internet Connection Discovery
  - Runs ping.exe
  PID:1156
- C:\Windows\system32\PING.EXE
  ping localhost -n 2
  2⤵
  - System Network Configuration Discovery: Internet Connection Discovery
  - Runs ping.exe
  PID:4020
- C:\Windows\system32\PING.EXE
  ping localhost -n 2
  2⤵
  - System Network Configuration Discovery: Internet Connection Discovery
  - Runs ping.exe
  PID:2620
- C:\Windows\system32\PING.EXE
  ping localhost -n 2
  2⤵
  - System Network Configuration Discovery: Internet Connection Discovery
  - Runs ping.exe
  PID:3308
- C:\Windows\system32\PING.EXE
  ping localhost -n 2
  2⤵
  - System Network Configuration Discovery: Internet Connection Discovery
  - Runs ping.exe
  PID:1772
- C:\Windows\system32\PING.EXE
  ping localhost -n 2
  2⤵
  - System Network Configuration Discovery: Internet Connection Discovery
  - Runs ping.exe
  PID:3184
- C:\Windows\system32\net.exe
  net stop GoogleChromeElevationService
  2⤵
  PID:4140
- - C:\Windows\system32\net1.exe
    C:\Windows\system32\net1 stop GoogleChromeElevationService
    3⤵
    PID:4768
- C:\Windows\system32\sc.exe
  sc config GoogleChromeElevationService start= Disabled
  2⤵
  - Launches sc.exe
  PID:5016
- C:\Windows\system32\net.exe
  net stop gupdate
  2⤵
  PID:3624
- - C:\Windows\system32\net1.exe
    C:\Windows\system32\net1 stop gupdate
    3⤵
    PID:3008
- C:\Windows\system32\sc.exe
  sc config gupdate start= Disabled
  2⤵
  - Launches sc.exe
  PID:4776
- C:\Windows\system32\net.exe
  net stop gupdatem
  2⤵
  PID:448
- - C:\Windows\system32\net1.exe
    C:\Windows\system32\net1 stop gupdatem
    3⤵
    PID:1276
- C:\Windows\system32\sc.exe
  sc config gupdatem start= Disabled
  2⤵
  - Launches sc.exe
  PID:1208
- C:\Windows\system32\PING.EXE
  ping localhost -n
  2⤵
  - System Network Configuration Discovery: Internet Connection Discovery
  - Runs ping.exe
  PID:3432
- C:\Windows\system32\PING.EXE
  ping localhost -n 2
  2⤵
  - System Network Configuration Discovery: Internet Connection Discovery
  - Runs ping.exe
  PID:496
- C:\Windows\system32\PING.EXE
  ping localhost -n 2
  2⤵
  - System Network Configuration Discovery: Internet Connection Discovery
  - Runs ping.exe
  PID:4060
- C:\Windows\system32\PING.EXE
  ping localhost -n 2
  2⤵
  - System Network Configuration Discovery: Internet Connection Discovery
  - Runs ping.exe
  PID:4716
- C:\Windows\system32\PING.EXE
  ping localhost -n 2
  2⤵
  - System Network Configuration Discovery: Internet Connection Discovery
  - Runs ping.exe
  PID:1416
- C:\Windows\system32\PING.EXE
  ping localhost -n 2
  2⤵
  - System Network Configuration Discovery: Internet Connection Discovery
  - Runs ping.exe
  PID:772
- C:\Windows\system32\PING.EXE
  ping localhost -n 2
  2⤵
  - System Network Configuration Discovery: Internet Connection Discovery
  - Runs ping.exe
  PID:4660
- C:\Windows\system32\PING.EXE
  ping localhost -n 5
  2⤵
  - System Network Configuration Discovery: Internet Connection Discovery
  - Runs ping.exe
  PID:2088