3b1189ee57ef95b9164a3908f33115d58e34edf0fc856ae256f7ec1910d86f21

Analysis

max time kernel
93s
max time network
141s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
30-11-2024 06:26

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

(Full Package) One Click OPT Ver - 6.7/1- One Click OPT/4 - Process Destroyer V2.1/Process Destroyer 2.1.bat
Size

3KB
MD5

07eb39b2e136e2b6346ef8d4d20465a1
SHA1

1396dc3772079e611a2cf738b6f67c65f3743704
SHA256

1eec0e628ad9eaeab06c2174c5f526e5ec305e948371507cd1aaaf56e7246cce
SHA512

092372ec030b7962d438123ee0a125dd0eeb2744ede249b6153c29a9f8b1c9c57be19eff64dd8f862d4d2063a2c268acda3cb6bb412481561f3636bf74dd4d67

Score

10^/10

defense_evasion evasion

Malware Config

Signatures

Modifies security service 2 TTPs 3 IoCs

evasion

Modify Registry

T1112

Windows Service

T1543.003

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\mpssvc\Start = "4"	reg.exe
Set value (int)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\wscsvc\Start = "4"	reg.exe
Set value (int)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\WinDefend\Start = "4"	reg.exe

Modifies Security services 2 TTPs 2 IoCs

Modifies the startup behavior of a security service.

defense_evasion

Modify Registry

T1112

Impair Defenses

T1562

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SecurityHealthService\Start = "4"	reg.exe
Set value (int)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\WdNisSvc\Start = "4"	reg.exe

Delays execution with timeout.exe 1 IoCs

evasion

pid	Process
3744	timeout.exe

Kills process with taskkill 3 IoCs

evasion

pid	Process
2524	taskkill.exe
4100	taskkill.exe
2684	taskkill.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

description	pid	Process
Token: SeDebugPrivilege	2524	taskkill.exe
Token: SeDebugPrivilege	4100	taskkill.exe
Token: SeDebugPrivilege	2684	taskkill.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4708 wrote to memory of 2524	4708	cmd.exe	84
PID 4708 wrote to memory of 2524	4708	cmd.exe	84
PID 4708 wrote to memory of 4100	4708	cmd.exe	86
PID 4708 wrote to memory of 4100	4708	cmd.exe	86
PID 4708 wrote to memory of 2684	4708	cmd.exe	87
PID 4708 wrote to memory of 2684	4708	cmd.exe	87
PID 4708 wrote to memory of 1988	4708	cmd.exe	89
PID 4708 wrote to memory of 1988	4708	cmd.exe	89
PID 4708 wrote to memory of 1808	4708	cmd.exe	90
PID 4708 wrote to memory of 1808	4708	cmd.exe	90
PID 4708 wrote to memory of 2284	4708	cmd.exe	91
PID 4708 wrote to memory of 2284	4708	cmd.exe	91
PID 4708 wrote to memory of 4876	4708	cmd.exe	92
PID 4708 wrote to memory of 4876	4708	cmd.exe	92
PID 4708 wrote to memory of 1700	4708	cmd.exe	93
PID 4708 wrote to memory of 1700	4708	cmd.exe	93
PID 4708 wrote to memory of 4716	4708	cmd.exe	94
PID 4708 wrote to memory of 4716	4708	cmd.exe	94
PID 4708 wrote to memory of 3200	4708	cmd.exe	95
PID 4708 wrote to memory of 3200	4708	cmd.exe	95
PID 4708 wrote to memory of 4244	4708	cmd.exe	96
PID 4708 wrote to memory of 4244	4708	cmd.exe	96
PID 4708 wrote to memory of 1620	4708	cmd.exe	97
PID 4708 wrote to memory of 1620	4708	cmd.exe	97
PID 4708 wrote to memory of 2120	4708	cmd.exe	98
PID 4708 wrote to memory of 2120	4708	cmd.exe	98
PID 4708 wrote to memory of 4480	4708	cmd.exe	99
PID 4708 wrote to memory of 4480	4708	cmd.exe	99
PID 4708 wrote to memory of 4092	4708	cmd.exe	100
PID 4708 wrote to memory of 4092	4708	cmd.exe	100
PID 4708 wrote to memory of 2992	4708	cmd.exe	101
PID 4708 wrote to memory of 2992	4708	cmd.exe	101
PID 4708 wrote to memory of 1800	4708	cmd.exe	102
PID 4708 wrote to memory of 1800	4708	cmd.exe	102
PID 4708 wrote to memory of 860	4708	cmd.exe	103
PID 4708 wrote to memory of 860	4708	cmd.exe	103
PID 4708 wrote to memory of 4368	4708	cmd.exe	104
PID 4708 wrote to memory of 4368	4708	cmd.exe	104
PID 4708 wrote to memory of 4864	4708	cmd.exe	105
PID 4708 wrote to memory of 4864	4708	cmd.exe	105
PID 4708 wrote to memory of 4276	4708	cmd.exe	106
PID 4708 wrote to memory of 4276	4708	cmd.exe	106
PID 4708 wrote to memory of 3088	4708	cmd.exe	107
PID 4708 wrote to memory of 3088	4708	cmd.exe	107
PID 4708 wrote to memory of 3152	4708	cmd.exe	108
PID 4708 wrote to memory of 3152	4708	cmd.exe	108
PID 4708 wrote to memory of 3104	4708	cmd.exe	109
PID 4708 wrote to memory of 3104	4708	cmd.exe	109
PID 4708 wrote to memory of 2776	4708	cmd.exe	110
PID 4708 wrote to memory of 2776	4708	cmd.exe	110
PID 4708 wrote to memory of 864	4708	cmd.exe	111
PID 4708 wrote to memory of 864	4708	cmd.exe	111
PID 4708 wrote to memory of 3628	4708	cmd.exe	112
PID 4708 wrote to memory of 3628	4708	cmd.exe	112
PID 4708 wrote to memory of 1220	4708	cmd.exe	113
PID 4708 wrote to memory of 1220	4708	cmd.exe	113
PID 4708 wrote to memory of 3080	4708	cmd.exe	114
PID 4708 wrote to memory of 3080	4708	cmd.exe	114
PID 4708 wrote to memory of 4880	4708	cmd.exe	115
PID 4708 wrote to memory of 4880	4708	cmd.exe	115
PID 4708 wrote to memory of 368	4708	cmd.exe	116
PID 4708 wrote to memory of 368	4708	cmd.exe	116
PID 4708 wrote to memory of 1468	4708	cmd.exe	117
PID 4708 wrote to memory of 1468	4708	cmd.exe	117

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\(Full Package) One Click OPT Ver - 6.7\1- One Click OPT\4 - Process Destroyer V2.1\Process Destroyer 2.1.bat"
1⤵
- Suspicious use of WriteProcessMemory
PID:4708
- C:\Windows\system32\taskkill.exe
  taskkill /f /im ctfmon.exe
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:2524
- C:\Windows\system32\taskkill.exe
  taskkill /f /im backgroundTaskHost.exe
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:4100
- C:\Windows\system32\taskkill.exe
  taskkill /f /im TextInputHost.exe
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:2684
- C:\Windows\system32\reg.exe
  reg.exe add "HKLM\SYSTEM\CurrentControlSet\Control\Class\{4d36e967-e325-11ce-bfc1-08002be10318}" /v "LowerFilters" /t REG_MULTI_SZ /d "" /f
  2⤵
  PID:1988
- C:\Windows\system32\reg.exe
  reg.exe add "HKLM\SYSTEM\CurrentControlSet\Control\Class\{4d36e96c-e325-11ce-bfc1-08002be10318}" /v "UpperFilters" /t REG_MULTI_SZ /d "" /f
  2⤵
  PID:1808
- C:\Windows\system32\reg.exe
  reg.exe add "HKLM\SYSTEM\CurrentControlSet\Control\Class\{6bdd1fc6-810f-11d0-bec7-08002be2092f}" /v "UpperFilters" /t REG_MULTI_SZ /d "" /f
  2⤵
  PID:2284
- C:\Windows\system32\reg.exe
  reg.exe add "HKLM\SYSTEM\CurrentControlSet\Control\Class\{71a27cdd-812a-11d0-bec7-08002be2092f}" /v "LowerFilters" /t REG_MULTI_SZ /d "" /f
  2⤵
  PID:4876
- C:\Windows\system32\reg.exe
  reg.exe add "HKLM\SYSTEM\CurrentControlSet\Control\Class\{ca3e7ab9-b4c3-4ae6-8251-579ef933890f}" /v "UpperFilters" /t REG_MULTI_SZ /d "" /f
  2⤵
  PID:1700
- C:\Windows\system32\reg.exe
  reg.exe add "HKLM\SYSTEM\CurrentControlSet\Services\NVDisplay.ContainerLocalSystem" /v "Start" /t REG_DWORD /d "4" /f
  2⤵
  PID:4716
- C:\Windows\system32\reg.exe
  reg.exe add "HKLM\SYSTEM\CurrentControlSet\Services\BFE" /v "Start" /t REG_DWORD /d "4" /f
  2⤵
  PID:3200
- C:\Windows\system32\reg.exe
  reg.exe add "HKLM\SYSTEM\CurrentControlSet\Services\mpssvc" /v "Start" /t REG_DWORD /d "4" /f
  2⤵
  - Modifies security service
  PID:4244
- C:\Windows\system32\reg.exe
  reg.exe add "HKLM\SYSTEM\CurrentControlSet\Services\webthreatdefsvc" /v "Start" /t REG_DWORD /d "4" /f
  2⤵
  PID:1620
- C:\Windows\system32\reg.exe
  reg.exe add "HKLM\SYSTEM\CurrentControlSet\Services\WpnUserService" /v "Start" /t REG_DWORD /d "4" /f
  2⤵
  PID:2120
- C:\Windows\system32\reg.exe
  reg.exe add "HKLM\SYSTEM\CurrentControlSet\Services\Dnscache" /v "Start" /t REG_DWORD /d "4" /f
  2⤵
  PID:4480
- C:\Windows\system32\reg.exe
  reg.exe add "HKLM\SYSTEM\CurrentControlSet\Services\SystemEventsBroker" /v "Start" /t REG_DWORD /d "4" /f
  2⤵
  PID:4092
- C:\Windows\system32\reg.exe
  reg.exe add "HKLM\SYSTEM\CurrentControlSet\Services\EventSystem" /v "Start" /t REG_DWORD /d "4" /f
  2⤵
  PID:2992
- C:\Windows\system32\reg.exe
  reg.exe add "HKLM\SYSTEM\CurrentControlSet\Services\AppIDSvc" /v "Start" /t REG_DWORD /d "4" /f
  2⤵
  PID:1800
- C:\Windows\system32\reg.exe
  reg.exe add "HKLM\SYSTEM\CurrentControlSet\Services\wscsvc" /v "Start" /t REG_DWORD /d "4" /f
  2⤵
  - Modifies security service
  PID:860
- C:\Windows\system32\reg.exe
  reg.exe add "HKLM\SYSTEM\CurrentControlSet\Services\NgcCtnrSvc" /v "Start" /t REG_DWORD /d "4" /f
  2⤵
  PID:4368
- C:\Windows\system32\reg.exe
  reg.exe add "HKLM\SYSTEM\CurrentControlSet\Services\TimeBrokerSvc" /v "Start" /t REG_DWORD /d "4" /f
  2⤵
  PID:4864
- C:\Windows\system32\reg.exe
  reg.exe add "HKLM\SYSTEM\CurrentControlSet\Services\WinHttpAutoProxySvc" /v "Start" /t REG_DWORD /d "4" /f
  2⤵
  PID:4276
- C:\Windows\system32\reg.exe
  reg.exe add "HKLM\SYSTEM\CurrentControlSet\Services\QWAVE" /v "Start" /t REG_DWORD /d "4" /f
  2⤵
  PID:3088
- C:\Windows\system32\reg.exe
  reg.exe add "HKLM\SYSTEM\CurrentControlSet\Services\seclogon" /v "Start" /t REG_DWORD /d "3" /f
  2⤵
  PID:3152
- C:\Windows\system32\reg.exe
  reg.exe add "HKLM\SYSTEM\CurrentControlSet\Services\SENS" /v "Start" /t REG_DWORD /d "4" /f
  2⤵
  PID:3104
- C:\Windows\system32\reg.exe
  reg.exe add "HKLM\SYSTEM\CurrentControlSet\Services\Schedule" /v "Start" /t REG_DWORD /d "4" /f
  2⤵
  PID:2776
- C:\Windows\system32\reg.exe
  reg.exe add "HKLM\SYSTEM\CurrentControlSet\Services\webthreatdefusersvc" /v "Start" /t REG_DWORD /d "4" /f
  2⤵
  PID:864
- C:\Windows\system32\reg.exe
  reg.exe add "HKLM\SYSTEM\CurrentControlSet\Services\hidserv" /v "Start" /t REG_DWORD /d "3" /f
  2⤵
  PID:3628
- C:\Windows\system32\reg.exe
  reg.exe add "HKLM\SYSTEM\CurrentControlSet\Services\NgcSvc" /v "Start" /t REG_DWORD /d "4" /f
  2⤵
  PID:1220
- C:\Windows\system32\reg.exe
  reg.exe add "HKLM\SYSTEM\CurrentControlSet\Services\sppsvc" /v "Start" /t REG_DWORD /d "4" /f
  2⤵
  PID:3080
- C:\Windows\system32\reg.exe
  reg.exe add "HKLM\SYSTEM\CurrentControlSet\Services\AppXSvc" /v "Start" /t REG_DWORD /d "4" /f
  2⤵
  PID:4880
- C:\Windows\system32\reg.exe
  reg.exe add "HKLM\SYSTEM\CurrentControlSet\Services\edgeupdate" /v "Start" /t REG_DWORD /d "4" /f
  2⤵
  PID:368
- C:\Windows\system32\reg.exe
  reg.exe add "HKLM\SYSTEM\CurrentControlSet\Services\edgeupdatem" /v "Start" /t REG_DWORD /d "4" /f
  2⤵
  PID:1468
- C:\Windows\system32\reg.exe
  reg.exe add "HKLM\SYSTEM\CurrentControlSet\Services\MicrosoftEdgeElevationService" /v "Start" /t REG_DWORD /d "4" /f
  2⤵
  PID:1684
- C:\Windows\system32\reg.exe
  reg.exe add "HKLM\SYSTEM\CurrentControlSet\Services\SecurityHealthService" /v "Start" /t REG_DWORD /d "4" /f
  2⤵
  - Modifies Security services
  PID:3036
- C:\Windows\system32\reg.exe
  reg.exe add "HKLM\SYSTEM\CurrentControlSet\Services\WinDefend" /v "Start" /t REG_DWORD /d "4" /f
  2⤵
  - Modifies security service
  PID:2700
- C:\Windows\system32\reg.exe
  reg.exe add "HKLM\SYSTEM\CurrentControlSet\Services\WdNisSvc" /v "Start" /t REG_DWORD /d "4" /f
  2⤵
  - Modifies Security services
  PID:2112
- C:\Windows\system32\reg.exe
  reg.exe add "HKLM\SYSTEM\CurrentControlSet\Services\SamSs" /v "Start" /t REG_DWORD /d "4" /f
  2⤵
  PID:3108
- C:\Windows\system32\reg.exe
  reg.exe add "HKLM\SYSTEM\CurrentControlSet\Services\VaultSvc" /v "Start" /t REG_DWORD /d "4" /f
  2⤵
  PID:4960
- C:\Windows\system32\reg.exe
  reg.exe add "HKLM\SYSTEM\CurrentControlSet\Services\LicenseManager" /v "Start" /t REG_DWORD /d "4" /f
  2⤵
  PID:4264
- C:\Windows\system32\reg.exe
  reg.exe add "HKLM\SYSTEM\CurrentControlSet\Services\gpsvc" /v "Start" /t REG_DWORD /d "4" /f
  2⤵
  PID:4576
- C:\Windows\system32\reg.exe
  reg.exe add "HKLM\SYSTEM\CurrentControlSet\Services\EventLog" /v "Start" /t REG_DWORD /d "4" /f
  2⤵
  PID:668
- C:\Windows\system32\reg.exe
  reg.exe add "HKLM\SYSTEM\CurrentControlSet\Services\PlugPlay" /v "Start" /t REG_DWORD /d "4" /f
  2⤵
  PID:3408
- C:\Windows\system32\reg.exe
  reg.exe add "HKLM\SYSTEM\CurrentControlSet\Services\SgrmBroker" /v "Start" /t REG_DWORD /d "4" /f
  2⤵
  PID:2724
- C:\Windows\system32\timeout.exe
  timeout 3
  2⤵
  - Delays execution with timeout.exe
  PID:3744

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Create or Modify System Process

T1543

Windows Service

T1543.003

Privilege Escalation

Create or Modify System Process

T1543

Windows Service

T1543.003

Defense Evasion

Impair Defenses

T1562

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads