13101216127da473cec5dda480c23c4db57e1f1a9d25f46c7595818c30cf1f52 | Triage

Analysis

max time kernel
119s
max time network
121s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
05-12-2024 02:08

Sharing

Report Analysis Logs

General

Target

$_63_/bn.bat
Size

147B
MD5

88416e9f6b3759064df76476c57b31fc
SHA1

ffc41b3c48cd5f5461807ac87968a78b060b78d5
SHA256

08c1f095933e606688e2166656e1d726eca5b7ae8240aacfa184ce8535e1baee
SHA512

602d1d262c0954e2dfff2e5616ebfb9d5baebb96300136fc665dc1e6bd969e0876525954de0a3b83df69ac04fcf64447af8a28ea31dba6c527e8197033197480

Score

1^/10

Malware Config

Signatures

Suspicious use of AdjustPrivilegeToken 3 IoCs

description	pid	Process
Token: SeBackupPrivilege	3020	SetACL64.exe
Token: SeRestorePrivilege	3020	SetACL64.exe
Token: SeTakeOwnershipPrivilege	3020	SetACL64.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2996 wrote to memory of 3020	2996	cmd.exe	29
PID 2996 wrote to memory of 3020	2996	cmd.exe	29
PID 2996 wrote to memory of 3020	2996	cmd.exe	29

C:\Windows\system32\cmd.exe
cmd /c "C:\Users\Admin\AppData\Local\Temp\$_63_\bn.bat"
1⤵
- Suspicious use of WriteProcessMemory
PID:2996
- C:\Users\Admin\AppData\Local\Temp\$_63_\SetACL64.exe
  SetACL64 -on "HKLM\SOFTWARE\Microsoft\Windows Defender" -ot reg -actn setowner -ownr "n:Administrators"
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  PID:3020

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads