6740d0ca97c88527b23da8c7f6e03066f9c529d0a2e8ff88ddbfed5f0fd34b27

Analysis

max time kernel
122s
max time network
124s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
21-01-2025 18:57

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

Oneclick-main/Downloads/Sound.bat
Size

1KB
MD5

aa79a42a515c7013ee6d746bc2033af8
SHA1

f703e84f64c5d8061f2aea7f636e57576b5bb2c6
SHA256

9989b6443318155275d5e8011e6395f57a9723444f06c7de78ad1a07a8049c6e
SHA512

4bcf14e930fa090d0efbad5416ea48bcdb162ddef00baf9433186736a238c3e1ff28c1fc8447a4749af2413856dd597257dbed3f7b80340d1ff0a63144c90e43

Score

4^/10

Malware Config

Signatures

Launches sc.exe 3 IoCs

Sc.exe is a Windows utlilty to control services on the system.

pid	Process
2544	sc.exe
2820	sc.exe
2240	sc.exe

Kills process with taskkill 5 IoCs

defense_evasion

pid	Process
2248	taskkill.exe
2932	taskkill.exe
2304	taskkill.exe
2864	taskkill.exe
2804	taskkill.exe

Runs net.exe

Suspicious use of AdjustPrivilegeToken 5 IoCs

description	pid	Process
Token: SeDebugPrivilege	2248	taskkill.exe
Token: SeDebugPrivilege	2932	taskkill.exe
Token: SeDebugPrivilege	2304	taskkill.exe
Token: SeDebugPrivilege	2864	taskkill.exe
Token: SeDebugPrivilege	2804	taskkill.exe

Suspicious use of WriteProcessMemory 42 IoCs

description	pid	Process	procid_target
PID 3004 wrote to memory of 2248	3004	cmd.exe	31
PID 3004 wrote to memory of 2248	3004	cmd.exe	31
PID 3004 wrote to memory of 2248	3004	cmd.exe	31
PID 3004 wrote to memory of 1908	3004	cmd.exe	33
PID 3004 wrote to memory of 1908	3004	cmd.exe	33
PID 3004 wrote to memory of 1908	3004	cmd.exe	33
PID 1908 wrote to memory of 2948	1908	net.exe	34
PID 1908 wrote to memory of 2948	1908	net.exe	34
PID 1908 wrote to memory of 2948	1908	net.exe	34
PID 3004 wrote to memory of 2544	3004	cmd.exe	35
PID 3004 wrote to memory of 2544	3004	cmd.exe	35
PID 3004 wrote to memory of 2544	3004	cmd.exe	35
PID 3004 wrote to memory of 2932	3004	cmd.exe	36
PID 3004 wrote to memory of 2932	3004	cmd.exe	36
PID 3004 wrote to memory of 2932	3004	cmd.exe	36
PID 3004 wrote to memory of 2304	3004	cmd.exe	37
PID 3004 wrote to memory of 2304	3004	cmd.exe	37
PID 3004 wrote to memory of 2304	3004	cmd.exe	37
PID 3004 wrote to memory of 2724	3004	cmd.exe	38
PID 3004 wrote to memory of 2724	3004	cmd.exe	38
PID 3004 wrote to memory of 2724	3004	cmd.exe	38
PID 2724 wrote to memory of 2440	2724	net.exe	39
PID 2724 wrote to memory of 2440	2724	net.exe	39
PID 2724 wrote to memory of 2440	2724	net.exe	39
PID 3004 wrote to memory of 2820	3004	cmd.exe	40
PID 3004 wrote to memory of 2820	3004	cmd.exe	40
PID 3004 wrote to memory of 2820	3004	cmd.exe	40
PID 3004 wrote to memory of 2864	3004	cmd.exe	41
PID 3004 wrote to memory of 2864	3004	cmd.exe	41
PID 3004 wrote to memory of 2864	3004	cmd.exe	41
PID 3004 wrote to memory of 2804	3004	cmd.exe	42
PID 3004 wrote to memory of 2804	3004	cmd.exe	42
PID 3004 wrote to memory of 2804	3004	cmd.exe	42
PID 3004 wrote to memory of 2824	3004	cmd.exe	43
PID 3004 wrote to memory of 2824	3004	cmd.exe	43
PID 3004 wrote to memory of 2824	3004	cmd.exe	43
PID 2824 wrote to memory of 2848	2824	net.exe	44
PID 2824 wrote to memory of 2848	2824	net.exe	44
PID 2824 wrote to memory of 2848	2824	net.exe	44
PID 3004 wrote to memory of 2240	3004	cmd.exe	45
PID 3004 wrote to memory of 2240	3004	cmd.exe	45
PID 3004 wrote to memory of 2240	3004	cmd.exe	45

C:\Windows\system32\cmd.exe
cmd /c "C:\Users\Admin\AppData\Local\Temp\Oneclick-main\Downloads\Sound.bat"
1⤵
- Suspicious use of WriteProcessMemory
PID:3004
- C:\Windows\system32\taskkill.exe
  taskkill /F /IM RtkAudUService64.exe
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:2248
- C:\Windows\system32\net.exe
  net stop "RtkAudioUniversalService"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1908
- - C:\Windows\system32\net1.exe
    C:\Windows\system32\net1 stop "RtkAudioUniversalService"
    3⤵
    PID:2948
- C:\Windows\system32\sc.exe
  sc config RtkAudioUniversalService start=disabled
  2⤵
  - Launches sc.exe
  PID:2544
- C:\Windows\system32\taskkill.exe
  taskkill /f /im SECOMNService.exe
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:2932
- C:\Windows\system32\taskkill.exe
  taskkill /f /im SECOCL.exe
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:2304
- C:\Windows\system32\net.exe
  net stop "SECOMNService"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2724
- - C:\Windows\system32\net1.exe
    C:\Windows\system32\net1 stop "SECOMNService"
    3⤵
    PID:2440
- C:\Windows\system32\sc.exe
  sc config SECOMNService start=disabled
  2⤵
  - Launches sc.exe
  PID:2820
- C:\Windows\system32\taskkill.exe
  taskkill /f /im VSHelper.exe
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:2864
- C:\Windows\system32\taskkill.exe
  taskkill /f /im VSSrv.exe
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:2804
- C:\Windows\system32\net.exe
  net stop "VSSrv"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2824
- - C:\Windows\system32\net1.exe
    C:\Windows\system32\net1 stop "VSSrv"
    3⤵
    PID:2848
- C:\Windows\system32\sc.exe
  sc config VSSrv start=disabled
  2⤵
  - Launches sc.exe
  PID:2240

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads