Overview
overview
10Static
static
10MsSavesSes...YY.bat
windows10-2004-x64
8MsSavesSes...YY.bat
windows10-ltsc 2021-x64
8MsSavesSes...YY.bat
windows11-21h2-x64
8MsSavesSes...YY.bat
windows7-x64
8MsSavesSes...O1.vbe
windows10-2004-x64
3MsSavesSes...O1.vbe
windows10-ltsc 2021-x64
3MsSavesSes...O1.vbe
windows11-21h2-x64
3MsSavesSes...O1.vbe
windows7-x64
3MsSavesSes...rf.exe
windows10-2004-x64
10MsSavesSes...rf.exe
windows10-ltsc 2021-x64
10MsSavesSes...rf.exe
windows11-21h2-x64
10MsSavesSes...rf.exe
windows7-x64
10MsSavesSes...le.vbs
windows10-2004-x64
1MsSavesSes...le.vbs
windows10-ltsc 2021-x64
1MsSavesSes...le.vbs
windows11-21h2-x64
1MsSavesSes...le.vbs
windows7-x64
1Analysis
-
max time kernel
93s -
max time network
96s -
platform
windows11-21h2_x64 -
resource
win11-20241007-en -
resource tags
arch:x64arch:x86image:win11-20241007-enlocale:en-usos:windows11-21h2-x64system -
submitted
01-12-2024 18:51
Behavioral task
behavioral1
Sample
MsSavesSessionDll/9KjI6fqbs0yhjc5d8qYY.bat
Resource
win10v2004-20241007-en
Behavioral task
behavioral2
Sample
MsSavesSessionDll/9KjI6fqbs0yhjc5d8qYY.bat
Resource
win10ltsc2021-20241023-en
Behavioral task
behavioral3
Sample
MsSavesSessionDll/9KjI6fqbs0yhjc5d8qYY.bat
Resource
win11-20241007-en
Behavioral task
behavioral4
Sample
MsSavesSessionDll/9KjI6fqbs0yhjc5d8qYY.bat
Resource
win7-20240903-en
Behavioral task
behavioral5
Sample
MsSavesSessionDll/KGvUTlEKtYKB1JaFEhyBUO1.vbe
Resource
win10v2004-20241007-en
Behavioral task
behavioral6
Sample
MsSavesSessionDll/KGvUTlEKtYKB1JaFEhyBUO1.vbe
Resource
win10ltsc2021-20241023-en
Behavioral task
behavioral7
Sample
MsSavesSessionDll/KGvUTlEKtYKB1JaFEhyBUO1.vbe
Resource
win11-20241007-en
Behavioral task
behavioral8
Sample
MsSavesSessionDll/KGvUTlEKtYKB1JaFEhyBUO1.vbe
Resource
win7-20240729-en
Behavioral task
behavioral9
Sample
MsSavesSessionDll/agentreviewPerf.exe
Resource
win10v2004-20241007-en
Behavioral task
behavioral10
Sample
MsSavesSessionDll/agentreviewPerf.exe
Resource
win10ltsc2021-20241023-en
Behavioral task
behavioral11
Sample
MsSavesSessionDll/agentreviewPerf.exe
Resource
win11-20241007-en
Behavioral task
behavioral12
Sample
MsSavesSessionDll/agentreviewPerf.exe
Resource
win7-20241010-en
Behavioral task
behavioral13
Sample
MsSavesSessionDll/file.vbs
Resource
win10v2004-20241007-en
Behavioral task
behavioral14
Sample
MsSavesSessionDll/file.vbs
Resource
win10ltsc2021-20241023-en
Behavioral task
behavioral15
Sample
MsSavesSessionDll/file.vbs
Resource
win11-20241007-en
Behavioral task
behavioral16
Sample
MsSavesSessionDll/file.vbs
Resource
win7-20240903-en
General
-
Target
MsSavesSessionDll/9KjI6fqbs0yhjc5d8qYY.bat
-
Size
154B
-
MD5
24c4210b146054c31eb1f4e01f0f4005
-
SHA1
340eb576f0bc822344328fa3edf6638a60124381
-
SHA256
bf807e7bc8dbbebecd7a334f77b9a0b0eec352846fd673bdeab482642002ae2f
-
SHA512
46554f3f2441374a05ceee70c477aed58717f4e7e05ab57daa494f38a8f2b67b2f462a4a170bf4d3c54340d689934ca38462ee77299bca84cfdd0a7fe07dfa92
Malware Config
Signatures
-
Disables Task Manager via registry modification
-
Modifies registry key 1 TTPs 1 IoCs
pid Process 4296 reg.exe -
Suspicious use of WriteProcessMemory 2 IoCs
description pid Process procid_target PID 3872 wrote to memory of 4296 3872 cmd.exe 78 PID 3872 wrote to memory of 4296 3872 cmd.exe 78
Processes
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\MsSavesSessionDll\9KjI6fqbs0yhjc5d8qYY.bat"1⤵
- Suspicious use of WriteProcessMemory
PID:3872 -
C:\Windows\system32\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\System /v DisableTaskMgr /t REG_DWORD /d 1 /f2⤵
- Modifies registry key
PID:4296
-