Overview
overview
10Static
static
5temp/temp/...er.bat
windows7-x64
1temp/temp/...er.bat
windows10-2004-x64
1temp/temp/...er.bat
windows7-x64
1temp/temp/...er.bat
windows10-2004-x64
1temp/temp/...ht.bat
windows7-x64
8temp/temp/...ht.bat
windows10-2004-x64
8temp/temp/...er.exe
windows7-x64
1temp/temp/...er.exe
windows10-2004-x64
1temp/temp/...er.exe
windows7-x64
1temp/temp/...er.exe
windows10-2004-x64
1temp/temp/...gs.vbs
windows7-x64
3temp/temp/...gs.vbs
windows10-2004-x64
1temp/temp/...ol.exe
windows7-x64
10temp/temp/...ol.exe
windows10-2004-x64
5temp/temp/...64.dll
windows7-x64
1temp/temp/...64.dll
windows10-2004-x64
1temp/temp/...64.dll
windows7-x64
1temp/temp/...64.dll
windows10-2004-x64
1temp/temp/...mp.exe
windows7-x64
10temp/temp/...mp.exe
windows10-2004-x64
10Analysis
-
max time kernel
118s -
max time network
124s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system -
submitted
20-01-2025 16:56
Behavioral task
behavioral1
Sample
temp/temp/temp/temp/Serial Checker.bat
Resource
win7-20240903-en
windows7-x64
Behavioral task
behavioral2
Sample
temp/temp/temp/temp/Serial Checker.bat
Resource
win10v2004-20241007-en
windows10-2004-x64
Behavioral task
behavioral3
Sample
temp/temp/temp/temp/cleaners/FortniteCleaner.bat
Resource
win7-20240903-en
windows7-x64
Behavioral task
behavioral4
Sample
temp/temp/temp/temp/cleaners/FortniteCleaner.bat
Resource
win10v2004-20241007-en
windows10-2004-x64
Behavioral task
behavioral5
Sample
temp/temp/temp/temp/cleaners/Midnight.bat
Resource
win7-20240903-en
windows7-x64
Behavioral task
behavioral6
Sample
temp/temp/temp/temp/cleaners/Midnight.bat
Resource
win10v2004-20241007-en
windows10-2004-x64
Behavioral task
behavioral7
Sample
temp/temp/temp/temp/cleaners/Toruney_Cleaner.exe
Resource
win7-20240729-en
windows7-x64
Behavioral task
behavioral8
Sample
temp/temp/temp/temp/cleaners/Toruney_Cleaner.exe
Resource
win10v2004-20241007-en
windows10-2004-x64
Behavioral task
behavioral9
Sample
temp/temp/temp/temp/cleaners/cleaner.exe
Resource
win7-20241010-en
windows7-x64
Behavioral task
behavioral10
Sample
temp/temp/temp/temp/cleaners/cleaner.exe
Resource
win10v2004-20241007-en
windows10-2004-x64
Behavioral task
behavioral11
Sample
temp/temp/temp/temp/d control need/Defender_Settings.vbs
Resource
win7-20241023-en
windows7-x64
Behavioral task
behavioral12
Sample
temp/temp/temp/temp/d control need/Defender_Settings.vbs
Resource
win10v2004-20241007-en
windows10-2004-x64
Behavioral task
behavioral13
Sample
temp/temp/temp/temp/d control need/dControl.exe
Resource
win7-20240903-en
windows7-x64
Behavioral task
behavioral14
Sample
temp/temp/temp/temp/d control need/dControl.exe
Resource
win10v2004-20241007-en
windows10-2004-x64
Behavioral task
behavioral15
Sample
temp/temp/temp/temp/libcrypto-3-x64.dll
Resource
win7-20240903-en
windows7-x64
Behavioral task
behavioral16
Sample
temp/temp/temp/temp/libcrypto-3-x64.dll
Resource
win10v2004-20241007-en
windows10-2004-x64
Behavioral task
behavioral17
Sample
temp/temp/temp/temp/libssl-3-x64.dll
Resource
win7-20240729-en
windows7-x64
Behavioral task
behavioral18
Sample
temp/temp/temp/temp/libssl-3-x64.dll
Resource
win10v2004-20241007-en
windows10-2004-x64
Behavioral task
behavioral19
Sample
temp/temp/temp/temp/vson I temp.exe
Resource
win7-20240903-en
windows7-x64
Behavioral task
behavioral20
Sample
temp/temp/temp/temp/vson I temp.exe
Resource
win10v2004-20241007-en
windows10-2004-x64
General
-
Target
temp/temp/temp/temp/Serial Checker.bat
-
Size
831B
-
MD5
119a816fb17e3c634deda5fa650bbb50
-
SHA1
ee6fbcfe647a2b943e991797b08e10e2dd9eef5f
-
SHA256
8e04607e18f90a99e360f4bffe37102b20006143859c87ae845694512b41094f
-
SHA512
78d69503835da46a427afb50fd3dcb7d0dc246b89751d42533afb8bf8a0a0e5f78f78d350507460b5b421af0ae4b822ee2a435ab1962bf411fa5d94a663d6e2d
Malware Config
Signatures
-
Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeIncreaseQuotaPrivilege 1736 WMIC.exe Token: SeSecurityPrivilege 1736 WMIC.exe Token: SeTakeOwnershipPrivilege 1736 WMIC.exe Token: SeLoadDriverPrivilege 1736 WMIC.exe Token: SeSystemProfilePrivilege 1736 WMIC.exe Token: SeSystemtimePrivilege 1736 WMIC.exe Token: SeProfSingleProcessPrivilege 1736 WMIC.exe Token: SeIncBasePriorityPrivilege 1736 WMIC.exe Token: SeCreatePagefilePrivilege 1736 WMIC.exe Token: SeBackupPrivilege 1736 WMIC.exe Token: SeRestorePrivilege 1736 WMIC.exe Token: SeShutdownPrivilege 1736 WMIC.exe Token: SeDebugPrivilege 1736 WMIC.exe Token: SeSystemEnvironmentPrivilege 1736 WMIC.exe Token: SeRemoteShutdownPrivilege 1736 WMIC.exe Token: SeUndockPrivilege 1736 WMIC.exe Token: SeManageVolumePrivilege 1736 WMIC.exe Token: 33 1736 WMIC.exe Token: 34 1736 WMIC.exe Token: 35 1736 WMIC.exe Token: SeIncreaseQuotaPrivilege 1736 WMIC.exe Token: SeSecurityPrivilege 1736 WMIC.exe Token: SeTakeOwnershipPrivilege 1736 WMIC.exe Token: SeLoadDriverPrivilege 1736 WMIC.exe Token: SeSystemProfilePrivilege 1736 WMIC.exe Token: SeSystemtimePrivilege 1736 WMIC.exe Token: SeProfSingleProcessPrivilege 1736 WMIC.exe Token: SeIncBasePriorityPrivilege 1736 WMIC.exe Token: SeCreatePagefilePrivilege 1736 WMIC.exe Token: SeBackupPrivilege 1736 WMIC.exe Token: SeRestorePrivilege 1736 WMIC.exe Token: SeShutdownPrivilege 1736 WMIC.exe Token: SeDebugPrivilege 1736 WMIC.exe Token: SeSystemEnvironmentPrivilege 1736 WMIC.exe Token: SeRemoteShutdownPrivilege 1736 WMIC.exe Token: SeUndockPrivilege 1736 WMIC.exe Token: SeManageVolumePrivilege 1736 WMIC.exe Token: 33 1736 WMIC.exe Token: 34 1736 WMIC.exe Token: 35 1736 WMIC.exe Token: SeIncreaseQuotaPrivilege 2480 WMIC.exe Token: SeSecurityPrivilege 2480 WMIC.exe Token: SeTakeOwnershipPrivilege 2480 WMIC.exe Token: SeLoadDriverPrivilege 2480 WMIC.exe Token: SeSystemProfilePrivilege 2480 WMIC.exe Token: SeSystemtimePrivilege 2480 WMIC.exe Token: SeProfSingleProcessPrivilege 2480 WMIC.exe Token: SeIncBasePriorityPrivilege 2480 WMIC.exe Token: SeCreatePagefilePrivilege 2480 WMIC.exe Token: SeBackupPrivilege 2480 WMIC.exe Token: SeRestorePrivilege 2480 WMIC.exe Token: SeShutdownPrivilege 2480 WMIC.exe Token: SeDebugPrivilege 2480 WMIC.exe Token: SeSystemEnvironmentPrivilege 2480 WMIC.exe Token: SeRemoteShutdownPrivilege 2480 WMIC.exe Token: SeUndockPrivilege 2480 WMIC.exe Token: SeManageVolumePrivilege 2480 WMIC.exe Token: 33 2480 WMIC.exe Token: 34 2480 WMIC.exe Token: 35 2480 WMIC.exe Token: SeIncreaseQuotaPrivilege 2480 WMIC.exe Token: SeSecurityPrivilege 2480 WMIC.exe Token: SeTakeOwnershipPrivilege 2480 WMIC.exe Token: SeLoadDriverPrivilege 2480 WMIC.exe -
Suspicious use of WriteProcessMemory 27 IoCs
description pid Process procid_target PID 2452 wrote to memory of 2648 2452 cmd.exe 32 PID 2452 wrote to memory of 2648 2452 cmd.exe 32 PID 2452 wrote to memory of 2648 2452 cmd.exe 32 PID 2452 wrote to memory of 1736 2452 cmd.exe 33 PID 2452 wrote to memory of 1736 2452 cmd.exe 33 PID 2452 wrote to memory of 1736 2452 cmd.exe 33 PID 2452 wrote to memory of 2480 2452 cmd.exe 35 PID 2452 wrote to memory of 2480 2452 cmd.exe 35 PID 2452 wrote to memory of 2480 2452 cmd.exe 35 PID 2452 wrote to memory of 2212 2452 cmd.exe 36 PID 2452 wrote to memory of 2212 2452 cmd.exe 36 PID 2452 wrote to memory of 2212 2452 cmd.exe 36 PID 2452 wrote to memory of 2724 2452 cmd.exe 37 PID 2452 wrote to memory of 2724 2452 cmd.exe 37 PID 2452 wrote to memory of 2724 2452 cmd.exe 37 PID 2452 wrote to memory of 2800 2452 cmd.exe 38 PID 2452 wrote to memory of 2800 2452 cmd.exe 38 PID 2452 wrote to memory of 2800 2452 cmd.exe 38 PID 2452 wrote to memory of 2676 2452 cmd.exe 39 PID 2452 wrote to memory of 2676 2452 cmd.exe 39 PID 2452 wrote to memory of 2676 2452 cmd.exe 39 PID 2452 wrote to memory of 2192 2452 cmd.exe 40 PID 2452 wrote to memory of 2192 2452 cmd.exe 40 PID 2452 wrote to memory of 2192 2452 cmd.exe 40 PID 2452 wrote to memory of 2888 2452 cmd.exe 41 PID 2452 wrote to memory of 2888 2452 cmd.exe 41 PID 2452 wrote to memory of 2888 2452 cmd.exe 41
Processes
-
C:\Windows\system32\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\temp\temp\temp\temp\Serial Checker.bat"1⤵
- Suspicious use of WriteProcessMemory
PID:2452 -
C:\Windows\system32\mode.commode con: cols=180 lines=622⤵PID:2648
-
-
C:\Windows\System32\Wbem\WMIC.exewmic diskdrive get serialnumber2⤵
- Suspicious use of AdjustPrivilegeToken
PID:1736
-
-
C:\Windows\System32\Wbem\WMIC.exewmic baseboard get serialnumber2⤵
- Suspicious use of AdjustPrivilegeToken
PID:2480
-
-
C:\Windows\System32\Wbem\WMIC.exewmic path win32_computersystemproduct get uuid2⤵PID:2212
-
-
C:\Windows\System32\Wbem\WMIC.exewmic PATH Win32_VideoController GET Description,PNPDeviceID2⤵PID:2724
-
-
C:\Windows\System32\Wbem\WMIC.exewmic memorychip get serialnumber2⤵PID:2800
-
-
C:\Windows\System32\Wbem\WMIC.exewmic csproduct get uuid2⤵PID:2676
-
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get processorid2⤵PID:2192
-
-
C:\Windows\System32\Wbem\WMIC.exewmic path Win32_NetworkAdapter where "PNPDeviceID like '%PCI%' AND NetConnectionStatus=2 AND AdapterTypeID='0'" get MacAddress2⤵PID:2888
-