13101216127da473cec5dda480c23c4db57e1f1a9d25f46c7595818c30cf1f52 | Triage

Analysis

max time kernel
149s
max time network
152s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
05-12-2024 02:08

Sharing

Report Analysis Logs

General

Target

$_63_/bn.bat
Size

147B
MD5

88416e9f6b3759064df76476c57b31fc
SHA1

ffc41b3c48cd5f5461807ac87968a78b060b78d5
SHA256

08c1f095933e606688e2166656e1d726eca5b7ae8240aacfa184ce8535e1baee
SHA512

602d1d262c0954e2dfff2e5616ebfb9d5baebb96300136fc665dc1e6bd969e0876525954de0a3b83df69ac04fcf64447af8a28ea31dba6c527e8197033197480

Score

1^/10

Malware Config

Signatures

Suspicious use of AdjustPrivilegeToken 3 IoCs

description	pid	Process
Token: SeBackupPrivilege	4772	SetACL64.exe
Token: SeRestorePrivilege	4772	SetACL64.exe
Token: SeTakeOwnershipPrivilege	4772	SetACL64.exe

Suspicious use of WriteProcessMemory 2 IoCs

description	pid	Process	procid_target
PID 3624 wrote to memory of 4772	3624	cmd.exe	84
PID 3624 wrote to memory of 4772	3624	cmd.exe	84

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\$_63_\bn.bat"
1⤵
- Suspicious use of WriteProcessMemory
PID:3624
- C:\Users\Admin\AppData\Local\Temp\$_63_\SetACL64.exe
  SetACL64 -on "HKLM\SOFTWARE\Microsoft\Windows Defender" -ot reg -actn setowner -ownr "n:Administrators"
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  PID:4772

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads