13101216127da473cec5dda480c23c4db57e1f1a9d25f46c7595818c30cf1f52

Analysis

max time kernel
95s
max time network
146s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
04/12/2024, 14:00

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

$_63_/bnz.bat
Size

2KB
MD5

a639b0bfefec4e4032cffe1a11e7c28a
SHA1

0247f009b3310e486a04ddc68c9123e184285407
SHA256

1cb11eaa7973052f97f53e33e65be14e9c17aaa95e8f43d20cc42f89db96f78b
SHA512

46b0a53cacfd9204884f50221fe2dd7e5607cf2abc16cfa4bc6edb076dc55228a07885bb511f475668a459895fd89407b1fd2a963fdfd764bd50b4bb92c04306

Score

1^/10

Malware Config

Signatures

Suspicious use of AdjustPrivilegeToken 21 IoCs

description	pid	Process
Token: SeBackupPrivilege	4324	SetACL64.exe
Token: SeRestorePrivilege	4324	SetACL64.exe
Token: SeTakeOwnershipPrivilege	4324	SetACL64.exe
Token: SeBackupPrivilege	2632	SetACL64.exe
Token: SeRestorePrivilege	2632	SetACL64.exe
Token: SeTakeOwnershipPrivilege	2632	SetACL64.exe
Token: SeBackupPrivilege	4736	SetACL64.exe
Token: SeRestorePrivilege	4736	SetACL64.exe
Token: SeTakeOwnershipPrivilege	4736	SetACL64.exe
Token: SeBackupPrivilege	872	SetACL64.exe
Token: SeRestorePrivilege	872	SetACL64.exe
Token: SeTakeOwnershipPrivilege	872	SetACL64.exe
Token: SeBackupPrivilege	3652	SetACL64.exe
Token: SeRestorePrivilege	3652	SetACL64.exe
Token: SeTakeOwnershipPrivilege	3652	SetACL64.exe
Token: SeBackupPrivilege	1036	SetACL64.exe
Token: SeRestorePrivilege	1036	SetACL64.exe
Token: SeTakeOwnershipPrivilege	1036	SetACL64.exe
Token: SeBackupPrivilege	4892	SetACL64.exe
Token: SeRestorePrivilege	4892	SetACL64.exe
Token: SeTakeOwnershipPrivilege	4892	SetACL64.exe

Suspicious use of WriteProcessMemory 40 IoCs

description	pid	Process	procid_target
PID 2544 wrote to memory of 4324	2544	cmd.exe	83
PID 2544 wrote to memory of 4324	2544	cmd.exe	83
PID 2544 wrote to memory of 2632	2544	cmd.exe	84
PID 2544 wrote to memory of 2632	2544	cmd.exe	84
PID 2544 wrote to memory of 4736	2544	cmd.exe	85
PID 2544 wrote to memory of 4736	2544	cmd.exe	85
PID 2544 wrote to memory of 872	2544	cmd.exe	86
PID 2544 wrote to memory of 872	2544	cmd.exe	86
PID 2544 wrote to memory of 3652	2544	cmd.exe	87
PID 2544 wrote to memory of 3652	2544	cmd.exe	87
PID 2544 wrote to memory of 1036	2544	cmd.exe	88
PID 2544 wrote to memory of 1036	2544	cmd.exe	88
PID 2544 wrote to memory of 4892	2544	cmd.exe	89
PID 2544 wrote to memory of 4892	2544	cmd.exe	89
PID 2544 wrote to memory of 3616	2544	cmd.exe	90
PID 2544 wrote to memory of 3616	2544	cmd.exe	90
PID 2544 wrote to memory of 428	2544	cmd.exe	91
PID 2544 wrote to memory of 428	2544	cmd.exe	91
PID 2544 wrote to memory of 960	2544	cmd.exe	92
PID 2544 wrote to memory of 960	2544	cmd.exe	92
PID 2544 wrote to memory of 1172	2544	cmd.exe	93
PID 2544 wrote to memory of 1172	2544	cmd.exe	93
PID 2544 wrote to memory of 4472	2544	cmd.exe	94
PID 2544 wrote to memory of 4472	2544	cmd.exe	94
PID 2544 wrote to memory of 3608	2544	cmd.exe	95
PID 2544 wrote to memory of 3608	2544	cmd.exe	95
PID 2544 wrote to memory of 3948	2544	cmd.exe	96
PID 2544 wrote to memory of 3948	2544	cmd.exe	96
PID 2544 wrote to memory of 4916	2544	cmd.exe	97
PID 2544 wrote to memory of 4916	2544	cmd.exe	97
PID 2544 wrote to memory of 2720	2544	cmd.exe	98
PID 2544 wrote to memory of 2720	2544	cmd.exe	98
PID 2544 wrote to memory of 5008	2544	cmd.exe	99
PID 2544 wrote to memory of 5008	2544	cmd.exe	99
PID 2544 wrote to memory of 2260	2544	cmd.exe	100
PID 2544 wrote to memory of 2260	2544	cmd.exe	100
PID 2544 wrote to memory of 4612	2544	cmd.exe	101
PID 2544 wrote to memory of 4612	2544	cmd.exe	101
PID 2544 wrote to memory of 1336	2544	cmd.exe	102
PID 2544 wrote to memory of 1336	2544	cmd.exe	102

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\$_63_\bnz.bat"
1⤵
- Suspicious use of WriteProcessMemory
PID:2544
- C:\Users\Admin\AppData\Local\Temp\$_63_\SetACL64.exe
  SetACL64 -on "HKLM\SOFTWARE\Microsoft\Windows Defender" -ot reg -actn ace -ace "n:Administrators;p:full"
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  PID:4324
- C:\Users\Admin\AppData\Local\Temp\$_63_\SetACL64.exe
  SetACL64 -on "HKLM\SOFTWARE\Microsoft\Windows Defender\Features" -ot reg -actn setowner -ownr "n:Administrators"
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  PID:2632
- C:\Users\Admin\AppData\Local\Temp\$_63_\SetACL64.exe
  SetACL64 -on "HKLM\SOFTWARE\Microsoft\Windows Defender\Features" -ot reg -actn ace -ace "n:Administrators;p:full"
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  PID:4736
- C:\Users\Admin\AppData\Local\Temp\$_63_\SetACL64.exe
  SetACL64 -on "HKLM\SOFTWARE\Microsoft\Windows Defender\Signature Updates" -ot reg -actn setowner -ownr "n:Administrators"
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  PID:872
- C:\Users\Admin\AppData\Local\Temp\$_63_\SetACL64.exe
  SetACL64 -on "HKLM\SOFTWARE\Microsoft\Windows Defender\Signature Updates" -ot reg -actn ace -ace "n:Administrators;p:full"
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  PID:3652
- C:\Users\Admin\AppData\Local\Temp\$_63_\SetACL64.exe
  SetACL64 -on "HKLM\SOFTWARE\Microsoft\Windows Defender\UX Configuration" -ot reg -actn setowner -ownr "n:Administrators"
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  PID:1036
- C:\Users\Admin\AppData\Local\Temp\$_63_\SetACL64.exe
  SetACL64 -on "HKLM\SOFTWARE\Microsoft\Windows Defender\UX Configuration" -ot reg -actn ace -ace "n:Administrators;p:full"
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  PID:4892
- C:\Windows\system32\reg.exe
  reg add "HKLM\SOFTWARE\Microsoft\Windows Defender" /v "DisableAntiVirus" /t reg_DWORD /d "1" /f
  2⤵
  PID:3616
- C:\Windows\system32\reg.exe
  reg add "HKLM\SOFTWARE\Microsoft\Windows Defender\Features" /v "TamperProtection" /t reg_DWORD /d "4" /f
  2⤵
  PID:428
- C:\Windows\system32\reg.exe
  reg add "HKLM\SOFTWARE\Microsoft\Windows Defender\Features" /v "TamperProtectionSource" /t reg_DWORD /d "2" /f
  2⤵
  PID:960
- C:\Windows\system32\reg.exe
  reg add "HKLM\SOFTWARE\Microsoft\Windows Defender\UX Configuration" /v "DisablePrivacyMode" /t reg_DWORD /d "1" /f
  2⤵
  PID:1172
- C:\Windows\system32\reg.exe
  reg add "HKLM\SYSTEM\CurrentControlSet\Control\WMI\Autologger\DefenderApiLogger" /v "Start" /t reg_DWORD /d "0" /f
  2⤵
  PID:4472
- C:\Windows\system32\reg.exe
  reg add "HKLM\SYSTEM\CurrentControlSet\Control\WMI\Autologger\DefenderAuditLogger" /v "Start" /t reg_DWORD /d "0" /f
  2⤵
  PID:3608
- C:\Windows\system32\reg.exe
  reg add "HKLM\SOFTWARE\Policies\Microsoft\MRT" /v "DontOfferThroughWUAU" /t reg_DWORD /d 1 /f
  2⤵
  PID:3948
- C:\Windows\system32\reg.exe
  reg add "HKLM\SOFTWARE\Policies\Microsoft\MRT" /v "DontReportInfectionInformation" /t reg_DWORD /d 1 /f
  2⤵
  PID:4916
- C:\Windows\system32\reg.exe
  reg add "HKLM\SOFTWARE\Microsoft\RemovalTools\MpGears" /v "SpyNetReportingLocation" /t reg_DWORD /d 0 /f
  2⤵
  PID:2720
- C:\Windows\system32\reg.exe
  reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows\System" /v "EnableSmartScreen" /t reg_DWORD /d 0 /f
  2⤵
  PID:5008
- C:\Windows\system32\reg.exe
  reg add "HKLM\SOFTWARE\Policies\Microsoft\MicrosoftEdge\PhishingFilter" /v "EnabledV9" /t reg_DWORD /d 0 /f
  2⤵
  PID:2260
- C:\Windows\system32\reg.exe
  reg add "HKLM\SOFTWARE\Policies\Microsoft\MicrosoftEdge\PhishingFilter" /v "PreventOverride" /t reg_DWORD /d 0 /f
  2⤵
  PID:4612
- C:\Windows\system32\reg.exe
  reg add "HKLM\SOFTWARE\Policies\Microsoft\Internet Explorer\PhishingFilter" /v "EnabledV9" /t reg_DWORD /d 0 /f
  2⤵
  PID:1336

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads