6740d0ca97c88527b23da8c7f6e03066f9c529d0a2e8ff88ddbfed5f0fd34b27

Analysis

max time kernel
121s
max time network
122s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
21-01-2025 18:57

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

OneclickTools/Sound/Sound.bat
Size

1KB
MD5

aa79a42a515c7013ee6d746bc2033af8
SHA1

f703e84f64c5d8061f2aea7f636e57576b5bb2c6
SHA256

9989b6443318155275d5e8011e6395f57a9723444f06c7de78ad1a07a8049c6e
SHA512

4bcf14e930fa090d0efbad5416ea48bcdb162ddef00baf9433186736a238c3e1ff28c1fc8447a4749af2413856dd597257dbed3f7b80340d1ff0a63144c90e43

Score

4^/10

Malware Config

Signatures

Launches sc.exe 3 IoCs

Sc.exe is a Windows utlilty to control services on the system.

pid	Process
2588	sc.exe
3060	sc.exe
2792	sc.exe

Kills process with taskkill 5 IoCs

defense_evasion

pid	Process
2576	taskkill.exe
2764	taskkill.exe
2824	taskkill.exe
2864	taskkill.exe
2820	taskkill.exe

Runs net.exe

Suspicious use of AdjustPrivilegeToken 5 IoCs

description	pid	Process
Token: SeDebugPrivilege	2764	taskkill.exe
Token: SeDebugPrivilege	2824	taskkill.exe
Token: SeDebugPrivilege	2864	taskkill.exe
Token: SeDebugPrivilege	2820	taskkill.exe
Token: SeDebugPrivilege	2576	taskkill.exe

Suspicious use of WriteProcessMemory 42 IoCs

description	pid	Process	procid_target
PID 2656 wrote to memory of 2764	2656	cmd.exe	32
PID 2656 wrote to memory of 2764	2656	cmd.exe	32
PID 2656 wrote to memory of 2764	2656	cmd.exe	32
PID 2656 wrote to memory of 2552	2656	cmd.exe	34
PID 2656 wrote to memory of 2552	2656	cmd.exe	34
PID 2656 wrote to memory of 2552	2656	cmd.exe	34
PID 2552 wrote to memory of 2384	2552	net.exe	35
PID 2552 wrote to memory of 2384	2552	net.exe	35
PID 2552 wrote to memory of 2384	2552	net.exe	35
PID 2656 wrote to memory of 2792	2656	cmd.exe	36
PID 2656 wrote to memory of 2792	2656	cmd.exe	36
PID 2656 wrote to memory of 2792	2656	cmd.exe	36
PID 2656 wrote to memory of 2824	2656	cmd.exe	37
PID 2656 wrote to memory of 2824	2656	cmd.exe	37
PID 2656 wrote to memory of 2824	2656	cmd.exe	37
PID 2656 wrote to memory of 2864	2656	cmd.exe	38
PID 2656 wrote to memory of 2864	2656	cmd.exe	38
PID 2656 wrote to memory of 2864	2656	cmd.exe	38
PID 2656 wrote to memory of 2684	2656	cmd.exe	39
PID 2656 wrote to memory of 2684	2656	cmd.exe	39
PID 2656 wrote to memory of 2684	2656	cmd.exe	39
PID 2684 wrote to memory of 2720	2684	net.exe	40
PID 2684 wrote to memory of 2720	2684	net.exe	40
PID 2684 wrote to memory of 2720	2684	net.exe	40
PID 2656 wrote to memory of 2588	2656	cmd.exe	41
PID 2656 wrote to memory of 2588	2656	cmd.exe	41
PID 2656 wrote to memory of 2588	2656	cmd.exe	41
PID 2656 wrote to memory of 2820	2656	cmd.exe	42
PID 2656 wrote to memory of 2820	2656	cmd.exe	42
PID 2656 wrote to memory of 2820	2656	cmd.exe	42
PID 2656 wrote to memory of 2576	2656	cmd.exe	43
PID 2656 wrote to memory of 2576	2656	cmd.exe	43
PID 2656 wrote to memory of 2576	2656	cmd.exe	43
PID 2656 wrote to memory of 784	2656	cmd.exe	44
PID 2656 wrote to memory of 784	2656	cmd.exe	44
PID 2656 wrote to memory of 784	2656	cmd.exe	44
PID 784 wrote to memory of 2984	784	net.exe	45
PID 784 wrote to memory of 2984	784	net.exe	45
PID 784 wrote to memory of 2984	784	net.exe	45
PID 2656 wrote to memory of 3060	2656	cmd.exe	46
PID 2656 wrote to memory of 3060	2656	cmd.exe	46
PID 2656 wrote to memory of 3060	2656	cmd.exe	46

C:\Windows\system32\cmd.exe
cmd /c "C:\Users\Admin\AppData\Local\Temp\OneclickTools\Sound\Sound.bat"
1⤵
- Suspicious use of WriteProcessMemory
PID:2656
- C:\Windows\system32\taskkill.exe
  taskkill /F /IM RtkAudUService64.exe
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:2764
- C:\Windows\system32\net.exe
  net stop "RtkAudioUniversalService"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2552
- - C:\Windows\system32\net1.exe
    C:\Windows\system32\net1 stop "RtkAudioUniversalService"
    3⤵
    PID:2384
- C:\Windows\system32\sc.exe
  sc config RtkAudioUniversalService start=disabled
  2⤵
  - Launches sc.exe
  PID:2792
- C:\Windows\system32\taskkill.exe
  taskkill /f /im SECOMNService.exe
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:2824
- C:\Windows\system32\taskkill.exe
  taskkill /f /im SECOCL.exe
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:2864
- C:\Windows\system32\net.exe
  net stop "SECOMNService"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2684
- - C:\Windows\system32\net1.exe
    C:\Windows\system32\net1 stop "SECOMNService"
    3⤵
    PID:2720
- C:\Windows\system32\sc.exe
  sc config SECOMNService start=disabled
  2⤵
  - Launches sc.exe
  PID:2588
- C:\Windows\system32\taskkill.exe
  taskkill /f /im VSHelper.exe
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:2820
- C:\Windows\system32\taskkill.exe
  taskkill /f /im VSSrv.exe
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:2576
- C:\Windows\system32\net.exe
  net stop "VSSrv"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:784
- - C:\Windows\system32\net1.exe
    C:\Windows\system32\net1 stop "VSSrv"
    3⤵
    PID:2984
- C:\Windows\system32\sc.exe
  sc config VSSrv start=disabled
  2⤵
  - Launches sc.exe
  PID:3060

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads