13101216127da473cec5dda480c23c4db57e1f1a9d25f46c7595818c30cf1f52

Analysis

max time kernel
92s
max time network
145s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
04-12-2024 13:57

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

$_63_/bnz.bat
Size

2KB
MD5

a639b0bfefec4e4032cffe1a11e7c28a
SHA1

0247f009b3310e486a04ddc68c9123e184285407
SHA256

1cb11eaa7973052f97f53e33e65be14e9c17aaa95e8f43d20cc42f89db96f78b
SHA512

46b0a53cacfd9204884f50221fe2dd7e5607cf2abc16cfa4bc6edb076dc55228a07885bb511f475668a459895fd89407b1fd2a963fdfd764bd50b4bb92c04306

Score

1^/10

Malware Config

Signatures

Suspicious use of AdjustPrivilegeToken 21 IoCs

description	pid	Process
Token: SeBackupPrivilege	3884	SetACL64.exe
Token: SeRestorePrivilege	3884	SetACL64.exe
Token: SeTakeOwnershipPrivilege	3884	SetACL64.exe
Token: SeBackupPrivilege	4336	SetACL64.exe
Token: SeRestorePrivilege	4336	SetACL64.exe
Token: SeTakeOwnershipPrivilege	4336	SetACL64.exe
Token: SeBackupPrivilege	4900	SetACL64.exe
Token: SeRestorePrivilege	4900	SetACL64.exe
Token: SeTakeOwnershipPrivilege	4900	SetACL64.exe
Token: SeBackupPrivilege	3908	SetACL64.exe
Token: SeRestorePrivilege	3908	SetACL64.exe
Token: SeTakeOwnershipPrivilege	3908	SetACL64.exe
Token: SeBackupPrivilege	1232	SetACL64.exe
Token: SeRestorePrivilege	1232	SetACL64.exe
Token: SeTakeOwnershipPrivilege	1232	SetACL64.exe
Token: SeBackupPrivilege	5012	SetACL64.exe
Token: SeRestorePrivilege	5012	SetACL64.exe
Token: SeTakeOwnershipPrivilege	5012	SetACL64.exe
Token: SeBackupPrivilege	3372	SetACL64.exe
Token: SeRestorePrivilege	3372	SetACL64.exe
Token: SeTakeOwnershipPrivilege	3372	SetACL64.exe

Suspicious use of WriteProcessMemory 40 IoCs

description	pid	Process	procid_target
PID 3832 wrote to memory of 3884	3832	cmd.exe	84
PID 3832 wrote to memory of 3884	3832	cmd.exe	84
PID 3832 wrote to memory of 4336	3832	cmd.exe	85
PID 3832 wrote to memory of 4336	3832	cmd.exe	85
PID 3832 wrote to memory of 4900	3832	cmd.exe	86
PID 3832 wrote to memory of 4900	3832	cmd.exe	86
PID 3832 wrote to memory of 3908	3832	cmd.exe	87
PID 3832 wrote to memory of 3908	3832	cmd.exe	87
PID 3832 wrote to memory of 1232	3832	cmd.exe	88
PID 3832 wrote to memory of 1232	3832	cmd.exe	88
PID 3832 wrote to memory of 5012	3832	cmd.exe	89
PID 3832 wrote to memory of 5012	3832	cmd.exe	89
PID 3832 wrote to memory of 3372	3832	cmd.exe	90
PID 3832 wrote to memory of 3372	3832	cmd.exe	90
PID 3832 wrote to memory of 1608	3832	cmd.exe	91
PID 3832 wrote to memory of 1608	3832	cmd.exe	91
PID 3832 wrote to memory of 4556	3832	cmd.exe	92
PID 3832 wrote to memory of 4556	3832	cmd.exe	92
PID 3832 wrote to memory of 3528	3832	cmd.exe	93
PID 3832 wrote to memory of 3528	3832	cmd.exe	93
PID 3832 wrote to memory of 3504	3832	cmd.exe	94
PID 3832 wrote to memory of 3504	3832	cmd.exe	94
PID 3832 wrote to memory of 664	3832	cmd.exe	95
PID 3832 wrote to memory of 664	3832	cmd.exe	95
PID 3832 wrote to memory of 2332	3832	cmd.exe	96
PID 3832 wrote to memory of 2332	3832	cmd.exe	96
PID 3832 wrote to memory of 3488	3832	cmd.exe	97
PID 3832 wrote to memory of 3488	3832	cmd.exe	97
PID 3832 wrote to memory of 1860	3832	cmd.exe	98
PID 3832 wrote to memory of 1860	3832	cmd.exe	98
PID 3832 wrote to memory of 1576	3832	cmd.exe	99
PID 3832 wrote to memory of 1576	3832	cmd.exe	99
PID 3832 wrote to memory of 3656	3832	cmd.exe	100
PID 3832 wrote to memory of 3656	3832	cmd.exe	100
PID 3832 wrote to memory of 4624	3832	cmd.exe	101
PID 3832 wrote to memory of 4624	3832	cmd.exe	101
PID 3832 wrote to memory of 776	3832	cmd.exe	102
PID 3832 wrote to memory of 776	3832	cmd.exe	102
PID 3832 wrote to memory of 1780	3832	cmd.exe	103
PID 3832 wrote to memory of 1780	3832	cmd.exe	103

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\$_63_\bnz.bat"
1⤵
- Suspicious use of WriteProcessMemory
PID:3832
- C:\Users\Admin\AppData\Local\Temp\$_63_\SetACL64.exe
  SetACL64 -on "HKLM\SOFTWARE\Microsoft\Windows Defender" -ot reg -actn ace -ace "n:Administrators;p:full"
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  PID:3884
- C:\Users\Admin\AppData\Local\Temp\$_63_\SetACL64.exe
  SetACL64 -on "HKLM\SOFTWARE\Microsoft\Windows Defender\Features" -ot reg -actn setowner -ownr "n:Administrators"
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  PID:4336
- C:\Users\Admin\AppData\Local\Temp\$_63_\SetACL64.exe
  SetACL64 -on "HKLM\SOFTWARE\Microsoft\Windows Defender\Features" -ot reg -actn ace -ace "n:Administrators;p:full"
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  PID:4900
- C:\Users\Admin\AppData\Local\Temp\$_63_\SetACL64.exe
  SetACL64 -on "HKLM\SOFTWARE\Microsoft\Windows Defender\Signature Updates" -ot reg -actn setowner -ownr "n:Administrators"
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  PID:3908
- C:\Users\Admin\AppData\Local\Temp\$_63_\SetACL64.exe
  SetACL64 -on "HKLM\SOFTWARE\Microsoft\Windows Defender\Signature Updates" -ot reg -actn ace -ace "n:Administrators;p:full"
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  PID:1232
- C:\Users\Admin\AppData\Local\Temp\$_63_\SetACL64.exe
  SetACL64 -on "HKLM\SOFTWARE\Microsoft\Windows Defender\UX Configuration" -ot reg -actn setowner -ownr "n:Administrators"
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  PID:5012
- C:\Users\Admin\AppData\Local\Temp\$_63_\SetACL64.exe
  SetACL64 -on "HKLM\SOFTWARE\Microsoft\Windows Defender\UX Configuration" -ot reg -actn ace -ace "n:Administrators;p:full"
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  PID:3372
- C:\Windows\system32\reg.exe
  reg add "HKLM\SOFTWARE\Microsoft\Windows Defender" /v "DisableAntiVirus" /t reg_DWORD /d "1" /f
  2⤵
  PID:1608
- C:\Windows\system32\reg.exe
  reg add "HKLM\SOFTWARE\Microsoft\Windows Defender\Features" /v "TamperProtection" /t reg_DWORD /d "4" /f
  2⤵
  PID:4556
- C:\Windows\system32\reg.exe
  reg add "HKLM\SOFTWARE\Microsoft\Windows Defender\Features" /v "TamperProtectionSource" /t reg_DWORD /d "2" /f
  2⤵
  PID:3528
- C:\Windows\system32\reg.exe
  reg add "HKLM\SOFTWARE\Microsoft\Windows Defender\UX Configuration" /v "DisablePrivacyMode" /t reg_DWORD /d "1" /f
  2⤵
  PID:3504
- C:\Windows\system32\reg.exe
  reg add "HKLM\SYSTEM\CurrentControlSet\Control\WMI\Autologger\DefenderApiLogger" /v "Start" /t reg_DWORD /d "0" /f
  2⤵
  PID:664
- C:\Windows\system32\reg.exe
  reg add "HKLM\SYSTEM\CurrentControlSet\Control\WMI\Autologger\DefenderAuditLogger" /v "Start" /t reg_DWORD /d "0" /f
  2⤵
  PID:2332
- C:\Windows\system32\reg.exe
  reg add "HKLM\SOFTWARE\Policies\Microsoft\MRT" /v "DontOfferThroughWUAU" /t reg_DWORD /d 1 /f
  2⤵
  PID:3488
- C:\Windows\system32\reg.exe
  reg add "HKLM\SOFTWARE\Policies\Microsoft\MRT" /v "DontReportInfectionInformation" /t reg_DWORD /d 1 /f
  2⤵
  PID:1860
- C:\Windows\system32\reg.exe
  reg add "HKLM\SOFTWARE\Microsoft\RemovalTools\MpGears" /v "SpyNetReportingLocation" /t reg_DWORD /d 0 /f
  2⤵
  PID:1576
- C:\Windows\system32\reg.exe
  reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows\System" /v "EnableSmartScreen" /t reg_DWORD /d 0 /f
  2⤵
  PID:3656
- C:\Windows\system32\reg.exe
  reg add "HKLM\SOFTWARE\Policies\Microsoft\MicrosoftEdge\PhishingFilter" /v "EnabledV9" /t reg_DWORD /d 0 /f
  2⤵
  PID:4624
- C:\Windows\system32\reg.exe
  reg add "HKLM\SOFTWARE\Policies\Microsoft\MicrosoftEdge\PhishingFilter" /v "PreventOverride" /t reg_DWORD /d 0 /f
  2⤵
  PID:776
- C:\Windows\system32\reg.exe
  reg add "HKLM\SOFTWARE\Policies\Microsoft\Internet Explorer\PhishingFilter" /v "EnabledV9" /t reg_DWORD /d 0 /f
  2⤵
  PID:1780

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads