f578d77e5264494fd9cf4b740953b12b348745c43cc256cc5339c6a91413f909

Analysis

max time kernel
14s
max time network
20s
platform
windows7_x64
resource
win7-20241010-en
resource tags

arch:x64arch:x86image:win7-20241010-enlocale:en-usos:windows7-x64system
submitted
23-11-2024 17:28

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

lcb spoofer_updated_quack/cleaners/Midnight.bat
Size

104KB
MD5

98c35392bddb76264b1004a0dbf67236
SHA1

2a32cd70da5f7a7fd43952d066f705538e980191
SHA256

5a21145b429b84651b8b30506382c7643e631bc917de152d70cf6aa8fdfb15b8
SHA512

532b6a175755d340f8f5424dadbbd1ee0dac1680979e2365000024a63d226869c12384600597276217b73be7664fe6735da96fd6fb9dc1bd8fa6a5208c219202
SSDEEP

768:l/KZzmezl/svUsfg8gVhCBL1oPY8xC01n5xpoL8oPlRPOpL5LvLpLjLgzJu/:Fg8gU61nvplxL5LvLpLjLw6

Score

8^/10

evasion execution

Malware Config

Signatures

Stops running service(s) 4 TTPs
evasion execution

Windows Service
T1543.003

Impair Defenses
T1562

Service Stop
T1489

Service Execution
T1569.002
Launches sc.exe 1 IoCs
Sc.exe is a Windows utlilty to control services on the system.

Processes:

sc.exe

pid process

1520 sc.exe

pid	process
1520	sc.exe

Kills process with taskkill 19 IoCs

evasion

Processes:

taskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exe

pid	process
3020	taskkill.exe
1564	taskkill.exe
368	taskkill.exe
2728	taskkill.exe
2160	taskkill.exe
1036	taskkill.exe
1616	taskkill.exe
1764	taskkill.exe
2848	taskkill.exe
1740	taskkill.exe
2804	taskkill.exe
2320	taskkill.exe
2464	taskkill.exe
2888	taskkill.exe
2780	taskkill.exe
2776	taskkill.exe
2864	taskkill.exe
2920	taskkill.exe
2448	taskkill.exe

Suspicious use of AdjustPrivilegeToken 19 IoCs

Processes:

description	pid	process
Token: SeDebugPrivilege	368	taskkill.exe
Token: SeDebugPrivilege	2888	taskkill.exe
Token: SeDebugPrivilege	2864	taskkill.exe
Token: SeDebugPrivilege	2848	taskkill.exe
Token: SeDebugPrivilege	2920	taskkill.exe
Token: SeDebugPrivilege	1740	taskkill.exe
Token: SeDebugPrivilege	2780	taskkill.exe
Token: SeDebugPrivilege	2728	taskkill.exe
Token: SeDebugPrivilege	2804	taskkill.exe
Token: SeDebugPrivilege	2776	taskkill.exe
Token: SeDebugPrivilege	2320	taskkill.exe
Token: SeDebugPrivilege	2160	taskkill.exe
Token: SeDebugPrivilege	1036	taskkill.exe
Token: SeDebugPrivilege	2448	taskkill.exe
Token: SeDebugPrivilege	2464	taskkill.exe
Token: SeDebugPrivilege	1616	taskkill.exe
Token: SeDebugPrivilege	3020	taskkill.exe
Token: SeDebugPrivilege	1764	taskkill.exe
Token: SeDebugPrivilege	1564	taskkill.exe

Suspicious use of WriteProcessMemory 60 IoCs

Processes:

cmd.exe

description	pid	process	target process
PID 2164 wrote to memory of 368	2164	cmd.exe	taskkill.exe
PID 2164 wrote to memory of 368	2164	cmd.exe	taskkill.exe
PID 2164 wrote to memory of 368	2164	cmd.exe	taskkill.exe
PID 2164 wrote to memory of 2888	2164	cmd.exe	taskkill.exe
PID 2164 wrote to memory of 2888	2164	cmd.exe	taskkill.exe
PID 2164 wrote to memory of 2888	2164	cmd.exe	taskkill.exe
PID 2164 wrote to memory of 2864	2164	cmd.exe	taskkill.exe
PID 2164 wrote to memory of 2864	2164	cmd.exe	taskkill.exe
PID 2164 wrote to memory of 2864	2164	cmd.exe	taskkill.exe
PID 2164 wrote to memory of 2848	2164	cmd.exe	taskkill.exe
PID 2164 wrote to memory of 2848	2164	cmd.exe	taskkill.exe
PID 2164 wrote to memory of 2848	2164	cmd.exe	taskkill.exe
PID 2164 wrote to memory of 2920	2164	cmd.exe	taskkill.exe
PID 2164 wrote to memory of 2920	2164	cmd.exe	taskkill.exe
PID 2164 wrote to memory of 2920	2164	cmd.exe	taskkill.exe
PID 2164 wrote to memory of 1740	2164	cmd.exe	taskkill.exe
PID 2164 wrote to memory of 1740	2164	cmd.exe	taskkill.exe
PID 2164 wrote to memory of 1740	2164	cmd.exe	taskkill.exe
PID 2164 wrote to memory of 2780	2164	cmd.exe	taskkill.exe
PID 2164 wrote to memory of 2780	2164	cmd.exe	taskkill.exe
PID 2164 wrote to memory of 2780	2164	cmd.exe	taskkill.exe
PID 2164 wrote to memory of 2728	2164	cmd.exe	taskkill.exe
PID 2164 wrote to memory of 2728	2164	cmd.exe	taskkill.exe
PID 2164 wrote to memory of 2728	2164	cmd.exe	taskkill.exe
PID 2164 wrote to memory of 2804	2164	cmd.exe	taskkill.exe
PID 2164 wrote to memory of 2804	2164	cmd.exe	taskkill.exe
PID 2164 wrote to memory of 2804	2164	cmd.exe	taskkill.exe
PID 2164 wrote to memory of 2776	2164	cmd.exe	taskkill.exe
PID 2164 wrote to memory of 2776	2164	cmd.exe	taskkill.exe
PID 2164 wrote to memory of 2776	2164	cmd.exe	taskkill.exe
PID 2164 wrote to memory of 2320	2164	cmd.exe	taskkill.exe
PID 2164 wrote to memory of 2320	2164	cmd.exe	taskkill.exe
PID 2164 wrote to memory of 2320	2164	cmd.exe	taskkill.exe
PID 2164 wrote to memory of 2160	2164	cmd.exe	taskkill.exe
PID 2164 wrote to memory of 2160	2164	cmd.exe	taskkill.exe
PID 2164 wrote to memory of 2160	2164	cmd.exe	taskkill.exe
PID 2164 wrote to memory of 1036	2164	cmd.exe	taskkill.exe
PID 2164 wrote to memory of 1036	2164	cmd.exe	taskkill.exe
PID 2164 wrote to memory of 1036	2164	cmd.exe	taskkill.exe
PID 2164 wrote to memory of 2448	2164	cmd.exe	taskkill.exe
PID 2164 wrote to memory of 2448	2164	cmd.exe	taskkill.exe
PID 2164 wrote to memory of 2448	2164	cmd.exe	taskkill.exe
PID 2164 wrote to memory of 2464	2164	cmd.exe	taskkill.exe
PID 2164 wrote to memory of 2464	2164	cmd.exe	taskkill.exe
PID 2164 wrote to memory of 2464	2164	cmd.exe	taskkill.exe
PID 2164 wrote to memory of 1616	2164	cmd.exe	taskkill.exe
PID 2164 wrote to memory of 1616	2164	cmd.exe	taskkill.exe
PID 2164 wrote to memory of 1616	2164	cmd.exe	taskkill.exe
PID 2164 wrote to memory of 3020	2164	cmd.exe	taskkill.exe
PID 2164 wrote to memory of 3020	2164	cmd.exe	taskkill.exe
PID 2164 wrote to memory of 3020	2164	cmd.exe	taskkill.exe
PID 2164 wrote to memory of 1764	2164	cmd.exe	taskkill.exe
PID 2164 wrote to memory of 1764	2164	cmd.exe	taskkill.exe
PID 2164 wrote to memory of 1764	2164	cmd.exe	taskkill.exe
PID 2164 wrote to memory of 1564	2164	cmd.exe	taskkill.exe
PID 2164 wrote to memory of 1564	2164	cmd.exe	taskkill.exe
PID 2164 wrote to memory of 1564	2164	cmd.exe	taskkill.exe
PID 2164 wrote to memory of 1520	2164	cmd.exe	sc.exe
PID 2164 wrote to memory of 1520	2164	cmd.exe	sc.exe
PID 2164 wrote to memory of 1520	2164	cmd.exe	sc.exe

C:\Windows\system32\cmd.exe
cmd /c "C:\Users\Admin\AppData\Local\Temp\lcb spoofer_updated_quack\cleaners\Midnight.bat"
1⤵
- Suspicious use of WriteProcessMemory
PID:2164
- C:\Windows\system32\taskkill.exe
  taskkill /f /im FortniteClient-Win64-Shipping_EAC.exe
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:368
- C:\Windows\system32\taskkill.exe
  taskkill /f /im FortniteClient-Win64-Shipping.exe
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:2888
- C:\Windows\system32\taskkill.exe
  taskkill /f /im FortniteClient-Win64-Shipping_BE.exe
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:2864
- C:\Windows\system32\taskkill.exe
  taskkill /f /im FortniteLauncher.exe
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:2848
- C:\Windows\system32\taskkill.exe
  taskkill /f /im EpicGamesLauncher.exe
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:2920
- C:\Windows\system32\taskkill.exe
  taskkill /f /im epicgameslauncher.exe
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:1740
- C:\Windows\system32\taskkill.exe
  taskkill /f /im FortniteClient-Win64-Shipping_EAC.exe
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:2780
- C:\Windows\system32\taskkill.exe
  taskkill /f /im FortniteClient-Win64-Shipping.exe
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:2728
- C:\Windows\system32\taskkill.exe
  taskkill /f /im FortniteClient-Win64-Shipping_BE.exe
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:2804
- C:\Windows\system32\taskkill.exe
  taskkill /f /im FortniteLauncher.exe
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:2776
- C:\Windows\system32\taskkill.exe
  taskkill /f /im EasyAntiCheat.exe
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:2320
- C:\Windows\system32\taskkill.exe
  taskkill /f /im BEService.exe
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:2160
- C:\Windows\system32\taskkill.exe
  taskkill /f /im BEServices.exe
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:1036
- C:\Windows\system32\taskkill.exe
  taskkill /f /im BattleEye.exe
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:2448
- C:\Windows\system32\taskkill.exe
  taskkill /f /im smartscreen.exe
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:2464
- C:\Windows\system32\taskkill.exe
  taskkill /f /im smartscreen.exe
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:1616
- C:\Windows\system32\taskkill.exe
  taskkill /f /im EasyAntiCheat.exe
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:3020
- C:\Windows\system32\taskkill.exe
  taskkill /f /im Agent.exe
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:1764
- C:\Windows\system32\taskkill.exe
  taskkill /f /im Client.exe
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:1564
- C:\Windows\system32\sc.exe
  Sc stop EasyAntiCheat
  2⤵
  - Launches sc.exe
  PID:1520

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

System Services

T1569

Service Execution

T1569.002

Persistence

Create or Modify System Process

T1543

Windows Service

T1543.003

Privilege Escalation

Create or Modify System Process

T1543

Windows Service

T1543.003

Defense Evasion

Impair Defenses

T1562

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Service Stop

T1489

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads