13101216127da473cec5dda480c23c4db57e1f1a9d25f46c7595818c30cf1f52 | Triage

Analysis

max time kernel
120s
max time network
121s
platform
windows7_x64
resource
win7-20240729-en
resource tags

arch:x64arch:x86image:win7-20240729-enlocale:en-usos:windows7-x64system
submitted
04-12-2024 14:00

Sharing

Report Analysis Logs

General

Target

$_63_/bn.bat
Size

147B
MD5

88416e9f6b3759064df76476c57b31fc
SHA1

ffc41b3c48cd5f5461807ac87968a78b060b78d5
SHA256

08c1f095933e606688e2166656e1d726eca5b7ae8240aacfa184ce8535e1baee
SHA512

602d1d262c0954e2dfff2e5616ebfb9d5baebb96300136fc665dc1e6bd969e0876525954de0a3b83df69ac04fcf64447af8a28ea31dba6c527e8197033197480

Score

1^/10

Malware Config

Signatures

Suspicious use of AdjustPrivilegeToken 3 IoCs

description	pid	Process
Token: SeBackupPrivilege	2696	SetACL64.exe
Token: SeRestorePrivilege	2696	SetACL64.exe
Token: SeTakeOwnershipPrivilege	2696	SetACL64.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2240 wrote to memory of 2696	2240	cmd.exe	31
PID 2240 wrote to memory of 2696	2240	cmd.exe	31
PID 2240 wrote to memory of 2696	2240	cmd.exe	31

C:\Windows\system32\cmd.exe
cmd /c "C:\Users\Admin\AppData\Local\Temp\$_63_\bn.bat"
1⤵
- Suspicious use of WriteProcessMemory
PID:2240
- C:\Users\Admin\AppData\Local\Temp\$_63_\SetACL64.exe
  SetACL64 -on "HKLM\SOFTWARE\Microsoft\Windows Defender" -ot reg -actn setowner -ownr "n:Administrators"
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  PID:2696

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads