6740d0ca97c88527b23da8c7f6e03066f9c529d0a2e8ff88ddbfed5f0fd34b27

Analysis

max time kernel
94s
max time network
144s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
21-01-2025 18:57

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

OneclickTools/Sound/Sound.bat
Size

1KB
MD5

aa79a42a515c7013ee6d746bc2033af8
SHA1

f703e84f64c5d8061f2aea7f636e57576b5bb2c6
SHA256

9989b6443318155275d5e8011e6395f57a9723444f06c7de78ad1a07a8049c6e
SHA512

4bcf14e930fa090d0efbad5416ea48bcdb162ddef00baf9433186736a238c3e1ff28c1fc8447a4749af2413856dd597257dbed3f7b80340d1ff0a63144c90e43

Score

4^/10

Malware Config

Signatures

Launches sc.exe 3 IoCs

Sc.exe is a Windows utlilty to control services on the system.

pid	Process
3572	sc.exe
3296	sc.exe
4952	sc.exe

Kills process with taskkill 5 IoCs

defense_evasion

pid	Process
3152	taskkill.exe
3748	taskkill.exe
1672	taskkill.exe
1712	taskkill.exe
2052	taskkill.exe

Runs net.exe

Suspicious use of AdjustPrivilegeToken 5 IoCs

description	pid	Process
Token: SeDebugPrivilege	3748	taskkill.exe
Token: SeDebugPrivilege	1672	taskkill.exe
Token: SeDebugPrivilege	1712	taskkill.exe
Token: SeDebugPrivilege	2052	taskkill.exe
Token: SeDebugPrivilege	3152	taskkill.exe

Suspicious use of WriteProcessMemory 28 IoCs

description	pid	Process	procid_target
PID 2548 wrote to memory of 3748	2548	cmd.exe	83
PID 2548 wrote to memory of 3748	2548	cmd.exe	83
PID 2548 wrote to memory of 1548	2548	cmd.exe	85
PID 2548 wrote to memory of 1548	2548	cmd.exe	85
PID 1548 wrote to memory of 884	1548	net.exe	86
PID 1548 wrote to memory of 884	1548	net.exe	86
PID 2548 wrote to memory of 3572	2548	cmd.exe	87
PID 2548 wrote to memory of 3572	2548	cmd.exe	87
PID 2548 wrote to memory of 1672	2548	cmd.exe	88
PID 2548 wrote to memory of 1672	2548	cmd.exe	88
PID 2548 wrote to memory of 1712	2548	cmd.exe	89
PID 2548 wrote to memory of 1712	2548	cmd.exe	89
PID 2548 wrote to memory of 3616	2548	cmd.exe	90
PID 2548 wrote to memory of 3616	2548	cmd.exe	90
PID 3616 wrote to memory of 4012	3616	net.exe	91
PID 3616 wrote to memory of 4012	3616	net.exe	91
PID 2548 wrote to memory of 3296	2548	cmd.exe	92
PID 2548 wrote to memory of 3296	2548	cmd.exe	92
PID 2548 wrote to memory of 2052	2548	cmd.exe	93
PID 2548 wrote to memory of 2052	2548	cmd.exe	93
PID 2548 wrote to memory of 3152	2548	cmd.exe	94
PID 2548 wrote to memory of 3152	2548	cmd.exe	94
PID 2548 wrote to memory of 3340	2548	cmd.exe	95
PID 2548 wrote to memory of 3340	2548	cmd.exe	95
PID 3340 wrote to memory of 3620	3340	net.exe	96
PID 3340 wrote to memory of 3620	3340	net.exe	96
PID 2548 wrote to memory of 4952	2548	cmd.exe	97
PID 2548 wrote to memory of 4952	2548	cmd.exe	97

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\OneclickTools\Sound\Sound.bat"
1⤵
- Suspicious use of WriteProcessMemory
PID:2548
- C:\Windows\system32\taskkill.exe
  taskkill /F /IM RtkAudUService64.exe
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:3748
- C:\Windows\system32\net.exe
  net stop "RtkAudioUniversalService"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1548
- - C:\Windows\system32\net1.exe
    C:\Windows\system32\net1 stop "RtkAudioUniversalService"
    3⤵
    PID:884
- C:\Windows\system32\sc.exe
  sc config RtkAudioUniversalService start=disabled
  2⤵
  - Launches sc.exe
  PID:3572
- C:\Windows\system32\taskkill.exe
  taskkill /f /im SECOMNService.exe
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:1672
- C:\Windows\system32\taskkill.exe
  taskkill /f /im SECOCL.exe
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:1712
- C:\Windows\system32\net.exe
  net stop "SECOMNService"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:3616
- - C:\Windows\system32\net1.exe
    C:\Windows\system32\net1 stop "SECOMNService"
    3⤵
    PID:4012
- C:\Windows\system32\sc.exe
  sc config SECOMNService start=disabled
  2⤵
  - Launches sc.exe
  PID:3296
- C:\Windows\system32\taskkill.exe
  taskkill /f /im VSHelper.exe
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:2052
- C:\Windows\system32\taskkill.exe
  taskkill /f /im VSSrv.exe
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:3152
- C:\Windows\system32\net.exe
  net stop "VSSrv"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:3340
- - C:\Windows\system32\net1.exe
    C:\Windows\system32\net1 stop "VSSrv"
    3⤵
    PID:3620
- C:\Windows\system32\sc.exe
  sc config VSSrv start=disabled
  2⤵
  - Launches sc.exe
  PID:4952

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads