6740d0ca97c88527b23da8c7f6e03066f9c529d0a2e8ff88ddbfed5f0fd34b27

Analysis

max time kernel
93s
max time network
140s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
21-01-2025 18:57

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

Oneclick-main/Downloads/Sound.bat
Size

1KB
MD5

aa79a42a515c7013ee6d746bc2033af8
SHA1

f703e84f64c5d8061f2aea7f636e57576b5bb2c6
SHA256

9989b6443318155275d5e8011e6395f57a9723444f06c7de78ad1a07a8049c6e
SHA512

4bcf14e930fa090d0efbad5416ea48bcdb162ddef00baf9433186736a238c3e1ff28c1fc8447a4749af2413856dd597257dbed3f7b80340d1ff0a63144c90e43

Score

4^/10

Malware Config

Signatures

Launches sc.exe 3 IoCs

Sc.exe is a Windows utlilty to control services on the system.

pid	Process
1916	sc.exe
2740	sc.exe
2536	sc.exe

Kills process with taskkill 5 IoCs

defense_evasion

pid	Process
2068	taskkill.exe
4920	taskkill.exe
1052	taskkill.exe
2252	taskkill.exe
4280	taskkill.exe

Runs net.exe

Suspicious use of AdjustPrivilegeToken 5 IoCs

description	pid	Process
Token: SeDebugPrivilege	4280	taskkill.exe
Token: SeDebugPrivilege	2068	taskkill.exe
Token: SeDebugPrivilege	4920	taskkill.exe
Token: SeDebugPrivilege	1052	taskkill.exe
Token: SeDebugPrivilege	2252	taskkill.exe

Suspicious use of WriteProcessMemory 28 IoCs

description	pid	Process	procid_target
PID 524 wrote to memory of 4280	524	cmd.exe	84
PID 524 wrote to memory of 4280	524	cmd.exe	84
PID 524 wrote to memory of 3332	524	cmd.exe	86
PID 524 wrote to memory of 3332	524	cmd.exe	86
PID 3332 wrote to memory of 1064	3332	net.exe	87
PID 3332 wrote to memory of 1064	3332	net.exe	87
PID 524 wrote to memory of 2740	524	cmd.exe	88
PID 524 wrote to memory of 2740	524	cmd.exe	88
PID 524 wrote to memory of 2068	524	cmd.exe	89
PID 524 wrote to memory of 2068	524	cmd.exe	89
PID 524 wrote to memory of 4920	524	cmd.exe	90
PID 524 wrote to memory of 4920	524	cmd.exe	90
PID 524 wrote to memory of 2716	524	cmd.exe	91
PID 524 wrote to memory of 2716	524	cmd.exe	91
PID 2716 wrote to memory of 1156	2716	net.exe	92
PID 2716 wrote to memory of 1156	2716	net.exe	92
PID 524 wrote to memory of 2536	524	cmd.exe	93
PID 524 wrote to memory of 2536	524	cmd.exe	93
PID 524 wrote to memory of 1052	524	cmd.exe	94
PID 524 wrote to memory of 1052	524	cmd.exe	94
PID 524 wrote to memory of 2252	524	cmd.exe	95
PID 524 wrote to memory of 2252	524	cmd.exe	95
PID 524 wrote to memory of 3572	524	cmd.exe	96
PID 524 wrote to memory of 3572	524	cmd.exe	96
PID 3572 wrote to memory of 4456	3572	net.exe	97
PID 3572 wrote to memory of 4456	3572	net.exe	97
PID 524 wrote to memory of 1916	524	cmd.exe	98
PID 524 wrote to memory of 1916	524	cmd.exe	98

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\Oneclick-main\Downloads\Sound.bat"
1⤵
- Suspicious use of WriteProcessMemory
PID:524
- C:\Windows\system32\taskkill.exe
  taskkill /F /IM RtkAudUService64.exe
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:4280
- C:\Windows\system32\net.exe
  net stop "RtkAudioUniversalService"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:3332
- - C:\Windows\system32\net1.exe
    C:\Windows\system32\net1 stop "RtkAudioUniversalService"
    3⤵
    PID:1064
- C:\Windows\system32\sc.exe
  sc config RtkAudioUniversalService start=disabled
  2⤵
  - Launches sc.exe
  PID:2740
- C:\Windows\system32\taskkill.exe
  taskkill /f /im SECOMNService.exe
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:2068
- C:\Windows\system32\taskkill.exe
  taskkill /f /im SECOCL.exe
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:4920
- C:\Windows\system32\net.exe
  net stop "SECOMNService"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2716
- - C:\Windows\system32\net1.exe
    C:\Windows\system32\net1 stop "SECOMNService"
    3⤵
    PID:1156
- C:\Windows\system32\sc.exe
  sc config SECOMNService start=disabled
  2⤵
  - Launches sc.exe
  PID:2536
- C:\Windows\system32\taskkill.exe
  taskkill /f /im VSHelper.exe
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:1052
- C:\Windows\system32\taskkill.exe
  taskkill /f /im VSSrv.exe
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:2252
- C:\Windows\system32\net.exe
  net stop "VSSrv"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:3572
- - C:\Windows\system32\net1.exe
    C:\Windows\system32\net1 stop "VSSrv"
    3⤵
    PID:4456
- C:\Windows\system32\sc.exe
  sc config VSSrv start=disabled
  2⤵
  - Launches sc.exe
  PID:1916

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads