Analysis
-
max time kernel
91s -
max time network
149s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system -
submitted
01-12-2024 11:38
Behavioral task
behavioral1
Sample
Lunar spoofer.exe
Resource
win10v2004-20241007-en
windows10-2004-x64
11 signatures
150 seconds
Behavioral task
behavioral2
Sample
serial_checker.bat
Resource
win10v2004-20241007-en
windows10-2004-x64
2 signatures
150 seconds
General
-
Target
serial_checker.bat
-
Size
1KB
-
MD5
efa2cd30989448f5690130b07ccce86a
-
SHA1
0c3203f67c67cf63d39894a0577f20d5dc1427e8
-
SHA256
86710039b7414ff861ca629c839e89eb5eaf74cff86129734c575e5716c1a552
-
SHA512
c2f7dfb10f311ba6684651ca4e8aee8408e5abf6c2f564ce2764c0bac8df07da0b742bedff992d2ff9f6b00a1d6b1423d09390653c0fd0d47303984183db358e
Score
1/10
Malware Config
Signatures
-
Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeIncreaseQuotaPrivilege 1868 WMIC.exe Token: SeSecurityPrivilege 1868 WMIC.exe Token: SeTakeOwnershipPrivilege 1868 WMIC.exe Token: SeLoadDriverPrivilege 1868 WMIC.exe Token: SeSystemProfilePrivilege 1868 WMIC.exe Token: SeSystemtimePrivilege 1868 WMIC.exe Token: SeProfSingleProcessPrivilege 1868 WMIC.exe Token: SeIncBasePriorityPrivilege 1868 WMIC.exe Token: SeCreatePagefilePrivilege 1868 WMIC.exe Token: SeBackupPrivilege 1868 WMIC.exe Token: SeRestorePrivilege 1868 WMIC.exe Token: SeShutdownPrivilege 1868 WMIC.exe Token: SeDebugPrivilege 1868 WMIC.exe Token: SeSystemEnvironmentPrivilege 1868 WMIC.exe Token: SeRemoteShutdownPrivilege 1868 WMIC.exe Token: SeUndockPrivilege 1868 WMIC.exe Token: SeManageVolumePrivilege 1868 WMIC.exe Token: 33 1868 WMIC.exe Token: 34 1868 WMIC.exe Token: 35 1868 WMIC.exe Token: 36 1868 WMIC.exe Token: SeIncreaseQuotaPrivilege 1868 WMIC.exe Token: SeSecurityPrivilege 1868 WMIC.exe Token: SeTakeOwnershipPrivilege 1868 WMIC.exe Token: SeLoadDriverPrivilege 1868 WMIC.exe Token: SeSystemProfilePrivilege 1868 WMIC.exe Token: SeSystemtimePrivilege 1868 WMIC.exe Token: SeProfSingleProcessPrivilege 1868 WMIC.exe Token: SeIncBasePriorityPrivilege 1868 WMIC.exe Token: SeCreatePagefilePrivilege 1868 WMIC.exe Token: SeBackupPrivilege 1868 WMIC.exe Token: SeRestorePrivilege 1868 WMIC.exe Token: SeShutdownPrivilege 1868 WMIC.exe Token: SeDebugPrivilege 1868 WMIC.exe Token: SeSystemEnvironmentPrivilege 1868 WMIC.exe Token: SeRemoteShutdownPrivilege 1868 WMIC.exe Token: SeUndockPrivilege 1868 WMIC.exe Token: SeManageVolumePrivilege 1868 WMIC.exe Token: 33 1868 WMIC.exe Token: 34 1868 WMIC.exe Token: 35 1868 WMIC.exe Token: 36 1868 WMIC.exe Token: SeIncreaseQuotaPrivilege 2496 WMIC.exe Token: SeSecurityPrivilege 2496 WMIC.exe Token: SeTakeOwnershipPrivilege 2496 WMIC.exe Token: SeLoadDriverPrivilege 2496 WMIC.exe Token: SeSystemProfilePrivilege 2496 WMIC.exe Token: SeSystemtimePrivilege 2496 WMIC.exe Token: SeProfSingleProcessPrivilege 2496 WMIC.exe Token: SeIncBasePriorityPrivilege 2496 WMIC.exe Token: SeCreatePagefilePrivilege 2496 WMIC.exe Token: SeBackupPrivilege 2496 WMIC.exe Token: SeRestorePrivilege 2496 WMIC.exe Token: SeShutdownPrivilege 2496 WMIC.exe Token: SeDebugPrivilege 2496 WMIC.exe Token: SeSystemEnvironmentPrivilege 2496 WMIC.exe Token: SeRemoteShutdownPrivilege 2496 WMIC.exe Token: SeUndockPrivilege 2496 WMIC.exe Token: SeManageVolumePrivilege 2496 WMIC.exe Token: 33 2496 WMIC.exe Token: 34 2496 WMIC.exe Token: 35 2496 WMIC.exe Token: 36 2496 WMIC.exe Token: SeIncreaseQuotaPrivilege 2496 WMIC.exe -
Suspicious use of WriteProcessMemory 38 IoCs
description pid Process procid_target PID 552 wrote to memory of 468 552 cmd.exe 83 PID 552 wrote to memory of 468 552 cmd.exe 83 PID 552 wrote to memory of 1868 552 cmd.exe 84 PID 552 wrote to memory of 1868 552 cmd.exe 84 PID 552 wrote to memory of 2088 552 cmd.exe 85 PID 552 wrote to memory of 2088 552 cmd.exe 85 PID 552 wrote to memory of 2496 552 cmd.exe 87 PID 552 wrote to memory of 2496 552 cmd.exe 87 PID 552 wrote to memory of 4816 552 cmd.exe 88 PID 552 wrote to memory of 4816 552 cmd.exe 88 PID 552 wrote to memory of 5044 552 cmd.exe 89 PID 552 wrote to memory of 5044 552 cmd.exe 89 PID 552 wrote to memory of 1576 552 cmd.exe 90 PID 552 wrote to memory of 1576 552 cmd.exe 90 PID 552 wrote to memory of 1280 552 cmd.exe 91 PID 552 wrote to memory of 1280 552 cmd.exe 91 PID 552 wrote to memory of 3500 552 cmd.exe 92 PID 552 wrote to memory of 3500 552 cmd.exe 92 PID 552 wrote to memory of 4308 552 cmd.exe 93 PID 552 wrote to memory of 4308 552 cmd.exe 93 PID 552 wrote to memory of 3372 552 cmd.exe 94 PID 552 wrote to memory of 3372 552 cmd.exe 94 PID 552 wrote to memory of 628 552 cmd.exe 95 PID 552 wrote to memory of 628 552 cmd.exe 95 PID 552 wrote to memory of 4064 552 cmd.exe 96 PID 552 wrote to memory of 4064 552 cmd.exe 96 PID 552 wrote to memory of 3252 552 cmd.exe 97 PID 552 wrote to memory of 3252 552 cmd.exe 97 PID 552 wrote to memory of 3404 552 cmd.exe 98 PID 552 wrote to memory of 3404 552 cmd.exe 98 PID 552 wrote to memory of 1988 552 cmd.exe 99 PID 552 wrote to memory of 1988 552 cmd.exe 99 PID 552 wrote to memory of 2748 552 cmd.exe 100 PID 552 wrote to memory of 2748 552 cmd.exe 100 PID 552 wrote to memory of 2984 552 cmd.exe 101 PID 552 wrote to memory of 2984 552 cmd.exe 101 PID 552 wrote to memory of 2844 552 cmd.exe 102 PID 552 wrote to memory of 2844 552 cmd.exe 102
Processes
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\serial_checker.bat"1⤵
- Suspicious use of WriteProcessMemory
PID:552 -
C:\Windows\system32\mode.comMODE 93, 622⤵PID:468
-
-
C:\Windows\System32\Wbem\WMIC.exewmic baseboard get serialnumber2⤵
- Suspicious use of AdjustPrivilegeToken
PID:1868
-
-
C:\Windows\system32\sort.exesort2⤵PID:2088
-
-
C:\Windows\System32\Wbem\WMIC.exewmic path win32_computersystemproduct get uuid2⤵
- Suspicious use of AdjustPrivilegeToken
PID:2496
-
-
C:\Windows\system32\sort.exesort2⤵PID:4816
-
-
C:\Windows\System32\Wbem\WMIC.exewmic csproduct get uuid2⤵PID:5044
-
-
C:\Windows\system32\sort.exesort2⤵PID:1576
-
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get serialnumber2⤵PID:1280
-
-
C:\Windows\system32\sort.exesort2⤵PID:3500
-
-
C:\Windows\System32\Wbem\WMIC.exewmic systemenclosure get serialnumber2⤵PID:4308
-
-
C:\Windows\system32\sort.exesort2⤵PID:3372
-
-
C:\Windows\System32\Wbem\WMIC.exewmic diskdrive get serialnumber2⤵PID:628
-
-
C:\Windows\system32\sort.exesort2⤵PID:4064
-
-
C:\Windows\System32\Wbem\WMIC.exewmic PATH Win32_VideoController GET Description, PNPDeviceID2⤵PID:3252
-
-
C:\Windows\system32\sort.exesort2⤵PID:3404
-
-
C:\Windows\System32\Wbem\WMIC.exewmic path Win32_NetworkAdapter where "PNPDeviceID like '%PCI%' AND NetConnectionStatus=2 AND AdapterTypeID='0'" get MacAddress2⤵PID:1988
-
-
C:\Windows\system32\sort.exesort2⤵PID:2748
-
-
C:\Windows\System32\Wbem\WMIC.exewmic memorychip get serialnumber2⤵PID:2984
-
-
C:\Windows\system32\sort.exesort2⤵PID:2844
-