f578d77e5264494fd9cf4b740953b12b348745c43cc256cc5339c6a91413f909

Analysis

max time kernel
121s
max time network
123s
platform
windows7_x64
resource
win7-20241023-en
resource tags

arch:x64arch:x86image:win7-20241023-enlocale:en-usos:windows7-x64system
submitted
23-11-2024 17:28

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

lcb spoofer_updated_quack/Serial Checker.bat
Size

831B
MD5

119a816fb17e3c634deda5fa650bbb50
SHA1

ee6fbcfe647a2b943e991797b08e10e2dd9eef5f
SHA256

8e04607e18f90a99e360f4bffe37102b20006143859c87ae845694512b41094f
SHA512

78d69503835da46a427afb50fd3dcb7d0dc246b89751d42533afb8bf8a0a0e5f78f78d350507460b5b421af0ae4b822ee2a435ab1962bf411fa5d94a663d6e2d

Score

1^/10

Malware Config

Signatures

Suspicious use of AdjustPrivilegeToken 64 IoCs

Processes:

WMIC.exeWMIC.exe

description	pid	process
Token: SeIncreaseQuotaPrivilege	2948	WMIC.exe
Token: SeSecurityPrivilege	2948	WMIC.exe
Token: SeTakeOwnershipPrivilege	2948	WMIC.exe
Token: SeLoadDriverPrivilege	2948	WMIC.exe
Token: SeSystemProfilePrivilege	2948	WMIC.exe
Token: SeSystemtimePrivilege	2948	WMIC.exe
Token: SeProfSingleProcessPrivilege	2948	WMIC.exe
Token: SeIncBasePriorityPrivilege	2948	WMIC.exe
Token: SeCreatePagefilePrivilege	2948	WMIC.exe
Token: SeBackupPrivilege	2948	WMIC.exe
Token: SeRestorePrivilege	2948	WMIC.exe
Token: SeShutdownPrivilege	2948	WMIC.exe
Token: SeDebugPrivilege	2948	WMIC.exe
Token: SeSystemEnvironmentPrivilege	2948	WMIC.exe
Token: SeRemoteShutdownPrivilege	2948	WMIC.exe
Token: SeUndockPrivilege	2948	WMIC.exe
Token: SeManageVolumePrivilege	2948	WMIC.exe
Token: 33	2948	WMIC.exe
Token: 34	2948	WMIC.exe
Token: 35	2948	WMIC.exe
Token: SeIncreaseQuotaPrivilege	2948	WMIC.exe
Token: SeSecurityPrivilege	2948	WMIC.exe
Token: SeTakeOwnershipPrivilege	2948	WMIC.exe
Token: SeLoadDriverPrivilege	2948	WMIC.exe
Token: SeSystemProfilePrivilege	2948	WMIC.exe
Token: SeSystemtimePrivilege	2948	WMIC.exe
Token: SeProfSingleProcessPrivilege	2948	WMIC.exe
Token: SeIncBasePriorityPrivilege	2948	WMIC.exe
Token: SeCreatePagefilePrivilege	2948	WMIC.exe
Token: SeBackupPrivilege	2948	WMIC.exe
Token: SeRestorePrivilege	2948	WMIC.exe
Token: SeShutdownPrivilege	2948	WMIC.exe
Token: SeDebugPrivilege	2948	WMIC.exe
Token: SeSystemEnvironmentPrivilege	2948	WMIC.exe
Token: SeRemoteShutdownPrivilege	2948	WMIC.exe
Token: SeUndockPrivilege	2948	WMIC.exe
Token: SeManageVolumePrivilege	2948	WMIC.exe
Token: 33	2948	WMIC.exe
Token: 34	2948	WMIC.exe
Token: 35	2948	WMIC.exe
Token: SeIncreaseQuotaPrivilege	1576	WMIC.exe
Token: SeSecurityPrivilege	1576	WMIC.exe
Token: SeTakeOwnershipPrivilege	1576	WMIC.exe
Token: SeLoadDriverPrivilege	1576	WMIC.exe
Token: SeSystemProfilePrivilege	1576	WMIC.exe
Token: SeSystemtimePrivilege	1576	WMIC.exe
Token: SeProfSingleProcessPrivilege	1576	WMIC.exe
Token: SeIncBasePriorityPrivilege	1576	WMIC.exe
Token: SeCreatePagefilePrivilege	1576	WMIC.exe
Token: SeBackupPrivilege	1576	WMIC.exe
Token: SeRestorePrivilege	1576	WMIC.exe
Token: SeShutdownPrivilege	1576	WMIC.exe
Token: SeDebugPrivilege	1576	WMIC.exe
Token: SeSystemEnvironmentPrivilege	1576	WMIC.exe
Token: SeRemoteShutdownPrivilege	1576	WMIC.exe
Token: SeUndockPrivilege	1576	WMIC.exe
Token: SeManageVolumePrivilege	1576	WMIC.exe
Token: 33	1576	WMIC.exe
Token: 34	1576	WMIC.exe
Token: 35	1576	WMIC.exe
Token: SeIncreaseQuotaPrivilege	1576	WMIC.exe
Token: SeSecurityPrivilege	1576	WMIC.exe
Token: SeTakeOwnershipPrivilege	1576	WMIC.exe
Token: SeLoadDriverPrivilege	1576	WMIC.exe

Suspicious use of WriteProcessMemory 27 IoCs

Processes:

cmd.exe

description	pid	process	target process
PID 2244 wrote to memory of 2944	2244	cmd.exe	mode.com
PID 2244 wrote to memory of 2944	2244	cmd.exe	mode.com
PID 2244 wrote to memory of 2944	2244	cmd.exe	mode.com
PID 2244 wrote to memory of 2948	2244	cmd.exe	WMIC.exe
PID 2244 wrote to memory of 2948	2244	cmd.exe	WMIC.exe
PID 2244 wrote to memory of 2948	2244	cmd.exe	WMIC.exe
PID 2244 wrote to memory of 1576	2244	cmd.exe	WMIC.exe
PID 2244 wrote to memory of 1576	2244	cmd.exe	WMIC.exe
PID 2244 wrote to memory of 1576	2244	cmd.exe	WMIC.exe
PID 2244 wrote to memory of 2804	2244	cmd.exe	WMIC.exe
PID 2244 wrote to memory of 2804	2244	cmd.exe	WMIC.exe
PID 2244 wrote to memory of 2804	2244	cmd.exe	WMIC.exe
PID 2244 wrote to memory of 2940	2244	cmd.exe	WMIC.exe
PID 2244 wrote to memory of 2940	2244	cmd.exe	WMIC.exe
PID 2244 wrote to memory of 2940	2244	cmd.exe	WMIC.exe
PID 2244 wrote to memory of 2700	2244	cmd.exe	WMIC.exe
PID 2244 wrote to memory of 2700	2244	cmd.exe	WMIC.exe
PID 2244 wrote to memory of 2700	2244	cmd.exe	WMIC.exe
PID 2244 wrote to memory of 2160	2244	cmd.exe	WMIC.exe
PID 2244 wrote to memory of 2160	2244	cmd.exe	WMIC.exe
PID 2244 wrote to memory of 2160	2244	cmd.exe	WMIC.exe
PID 2244 wrote to memory of 2172	2244	cmd.exe	WMIC.exe
PID 2244 wrote to memory of 2172	2244	cmd.exe	WMIC.exe
PID 2244 wrote to memory of 2172	2244	cmd.exe	WMIC.exe
PID 2244 wrote to memory of 572	2244	cmd.exe	WMIC.exe
PID 2244 wrote to memory of 572	2244	cmd.exe	WMIC.exe
PID 2244 wrote to memory of 572	2244	cmd.exe	WMIC.exe

C:\Windows\system32\cmd.exe
cmd /c "C:\Users\Admin\AppData\Local\Temp\lcb spoofer_updated_quack\Serial Checker.bat"
1⤵
- Suspicious use of WriteProcessMemory
PID:2244
- C:\Windows\system32\mode.com
  mode con: cols=180 lines=62
  2⤵
  PID:2944
- C:\Windows\System32\Wbem\WMIC.exe
  wmic diskdrive get serialnumber
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  PID:2948
- C:\Windows\System32\Wbem\WMIC.exe
  wmic baseboard get serialnumber
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  PID:1576
- C:\Windows\System32\Wbem\WMIC.exe
  wmic path win32_computersystemproduct get uuid
  2⤵
  PID:2804
- C:\Windows\System32\Wbem\WMIC.exe
  wmic PATH Win32_VideoController GET Description,PNPDeviceID
  2⤵
  PID:2940
- C:\Windows\System32\Wbem\WMIC.exe
  wmic memorychip get serialnumber
  2⤵
  PID:2700
- C:\Windows\System32\Wbem\WMIC.exe
  wmic csproduct get uuid
  2⤵
  PID:2160
- C:\Windows\System32\Wbem\WMIC.exe
  wmic cpu get processorid
  2⤵
  PID:2172
- C:\Windows\System32\Wbem\WMIC.exe
  wmic path Win32_NetworkAdapter where "PNPDeviceID like '%PCI%' AND NetConnectionStatus=2 AND AdapterTypeID='0'" get MacAddress
  2⤵
  PID:572

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads