bde9aa21edb27047da788869a13e5f81f6fc8beca594f07fb70236dca1a1f139

Resubmissions

20-01-2025 15:14

250120-smhfjavqhx 10

20-01-2025 15:13

250120-sl6rqsvqgs 10

Analysis

max time kernel
91s
max time network
147s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
20-01-2025 15:14

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

temp/temp/temp/temp/Serial Checker.bat
Size

831B
MD5

119a816fb17e3c634deda5fa650bbb50
SHA1

ee6fbcfe647a2b943e991797b08e10e2dd9eef5f
SHA256

8e04607e18f90a99e360f4bffe37102b20006143859c87ae845694512b41094f
SHA512

78d69503835da46a427afb50fd3dcb7d0dc246b89751d42533afb8bf8a0a0e5f78f78d350507460b5b421af0ae4b822ee2a435ab1962bf411fa5d94a663d6e2d

Score

1^/10

Malware Config

Signatures

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeIncreaseQuotaPrivilege	3100	WMIC.exe
Token: SeSecurityPrivilege	3100	WMIC.exe
Token: SeTakeOwnershipPrivilege	3100	WMIC.exe
Token: SeLoadDriverPrivilege	3100	WMIC.exe
Token: SeSystemProfilePrivilege	3100	WMIC.exe
Token: SeSystemtimePrivilege	3100	WMIC.exe
Token: SeProfSingleProcessPrivilege	3100	WMIC.exe
Token: SeIncBasePriorityPrivilege	3100	WMIC.exe
Token: SeCreatePagefilePrivilege	3100	WMIC.exe
Token: SeBackupPrivilege	3100	WMIC.exe
Token: SeRestorePrivilege	3100	WMIC.exe
Token: SeShutdownPrivilege	3100	WMIC.exe
Token: SeDebugPrivilege	3100	WMIC.exe
Token: SeSystemEnvironmentPrivilege	3100	WMIC.exe
Token: SeRemoteShutdownPrivilege	3100	WMIC.exe
Token: SeUndockPrivilege	3100	WMIC.exe
Token: SeManageVolumePrivilege	3100	WMIC.exe
Token: 33	3100	WMIC.exe
Token: 34	3100	WMIC.exe
Token: 35	3100	WMIC.exe
Token: 36	3100	WMIC.exe
Token: SeIncreaseQuotaPrivilege	3100	WMIC.exe
Token: SeSecurityPrivilege	3100	WMIC.exe
Token: SeTakeOwnershipPrivilege	3100	WMIC.exe
Token: SeLoadDriverPrivilege	3100	WMIC.exe
Token: SeSystemProfilePrivilege	3100	WMIC.exe
Token: SeSystemtimePrivilege	3100	WMIC.exe
Token: SeProfSingleProcessPrivilege	3100	WMIC.exe
Token: SeIncBasePriorityPrivilege	3100	WMIC.exe
Token: SeCreatePagefilePrivilege	3100	WMIC.exe
Token: SeBackupPrivilege	3100	WMIC.exe
Token: SeRestorePrivilege	3100	WMIC.exe
Token: SeShutdownPrivilege	3100	WMIC.exe
Token: SeDebugPrivilege	3100	WMIC.exe
Token: SeSystemEnvironmentPrivilege	3100	WMIC.exe
Token: SeRemoteShutdownPrivilege	3100	WMIC.exe
Token: SeUndockPrivilege	3100	WMIC.exe
Token: SeManageVolumePrivilege	3100	WMIC.exe
Token: 33	3100	WMIC.exe
Token: 34	3100	WMIC.exe
Token: 35	3100	WMIC.exe
Token: 36	3100	WMIC.exe
Token: SeIncreaseQuotaPrivilege	4448	WMIC.exe
Token: SeSecurityPrivilege	4448	WMIC.exe
Token: SeTakeOwnershipPrivilege	4448	WMIC.exe
Token: SeLoadDriverPrivilege	4448	WMIC.exe
Token: SeSystemProfilePrivilege	4448	WMIC.exe
Token: SeSystemtimePrivilege	4448	WMIC.exe
Token: SeProfSingleProcessPrivilege	4448	WMIC.exe
Token: SeIncBasePriorityPrivilege	4448	WMIC.exe
Token: SeCreatePagefilePrivilege	4448	WMIC.exe
Token: SeBackupPrivilege	4448	WMIC.exe
Token: SeRestorePrivilege	4448	WMIC.exe
Token: SeShutdownPrivilege	4448	WMIC.exe
Token: SeDebugPrivilege	4448	WMIC.exe
Token: SeSystemEnvironmentPrivilege	4448	WMIC.exe
Token: SeRemoteShutdownPrivilege	4448	WMIC.exe
Token: SeUndockPrivilege	4448	WMIC.exe
Token: SeManageVolumePrivilege	4448	WMIC.exe
Token: 33	4448	WMIC.exe
Token: 34	4448	WMIC.exe
Token: 35	4448	WMIC.exe
Token: 36	4448	WMIC.exe
Token: SeIncreaseQuotaPrivilege	4448	WMIC.exe

Suspicious use of WriteProcessMemory 18 IoCs

description	pid	Process	procid_target
PID 2872 wrote to memory of 4384	2872	cmd.exe	84
PID 2872 wrote to memory of 4384	2872	cmd.exe	84
PID 2872 wrote to memory of 3100	2872	cmd.exe	85
PID 2872 wrote to memory of 3100	2872	cmd.exe	85
PID 2872 wrote to memory of 4448	2872	cmd.exe	87
PID 2872 wrote to memory of 4448	2872	cmd.exe	87
PID 2872 wrote to memory of 2436	2872	cmd.exe	88
PID 2872 wrote to memory of 2436	2872	cmd.exe	88
PID 2872 wrote to memory of 1384	2872	cmd.exe	89
PID 2872 wrote to memory of 1384	2872	cmd.exe	89
PID 2872 wrote to memory of 3508	2872	cmd.exe	90
PID 2872 wrote to memory of 3508	2872	cmd.exe	90
PID 2872 wrote to memory of 1992	2872	cmd.exe	91
PID 2872 wrote to memory of 1992	2872	cmd.exe	91
PID 2872 wrote to memory of 5008	2872	cmd.exe	92
PID 2872 wrote to memory of 5008	2872	cmd.exe	92
PID 2872 wrote to memory of 4984	2872	cmd.exe	93
PID 2872 wrote to memory of 4984	2872	cmd.exe	93

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\temp\temp\temp\temp\Serial Checker.bat"
1⤵
- Suspicious use of WriteProcessMemory
PID:2872
- C:\Windows\system32\mode.com
  mode con: cols=180 lines=62
  2⤵
  PID:4384
- C:\Windows\System32\Wbem\WMIC.exe
  wmic diskdrive get serialnumber
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  PID:3100
- C:\Windows\System32\Wbem\WMIC.exe
  wmic baseboard get serialnumber
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  PID:4448
- C:\Windows\System32\Wbem\WMIC.exe
  wmic path win32_computersystemproduct get uuid
  2⤵
  PID:2436
- C:\Windows\System32\Wbem\WMIC.exe
  wmic PATH Win32_VideoController GET Description,PNPDeviceID
  2⤵
  PID:1384
- C:\Windows\System32\Wbem\WMIC.exe
  wmic memorychip get serialnumber
  2⤵
  PID:3508
- C:\Windows\System32\Wbem\WMIC.exe
  wmic csproduct get uuid
  2⤵
  PID:1992
- C:\Windows\System32\Wbem\WMIC.exe
  wmic cpu get processorid
  2⤵
  PID:5008
- C:\Windows\System32\Wbem\WMIC.exe
  wmic path Win32_NetworkAdapter where "PNPDeviceID like '%PCI%' AND NetConnectionStatus=2 AND AdapterTypeID='0'" get MacAddress
  2⤵
  PID:4984

Resubmissions

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads