f15a78efd211bae6dd492d449beeb3844bd758a5241cfa48d0fd19dbe766102d

Analysis

max time kernel
94s
max time network
123s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
26-01-2025 00:53

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

perm/serials/SerialsChecker.bat
Size

534B
MD5

24e3d5bcc9303227287318776960b7a2
SHA1

5c66afdccf6ac0f84a5ba218d4fbea8d5975b5c7
SHA256

28d007fe953bc08f5e41a5c1a25f9e0436bf3420ef788fcb7e8c9293badb9d42
SHA512

2998f2cd8349b94d538b0a69ebe04fd2288a2c0484e95ba90dcebf422eb012d0899cc0bf54ad9747e9d7d0d2909bb659a5fc6ecc4d602281be5384aaf3327033

Score

1^/10

Malware Config

Signatures

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeIncreaseQuotaPrivilege	5096	WMIC.exe
Token: SeSecurityPrivilege	5096	WMIC.exe
Token: SeTakeOwnershipPrivilege	5096	WMIC.exe
Token: SeLoadDriverPrivilege	5096	WMIC.exe
Token: SeSystemProfilePrivilege	5096	WMIC.exe
Token: SeSystemtimePrivilege	5096	WMIC.exe
Token: SeProfSingleProcessPrivilege	5096	WMIC.exe
Token: SeIncBasePriorityPrivilege	5096	WMIC.exe
Token: SeCreatePagefilePrivilege	5096	WMIC.exe
Token: SeBackupPrivilege	5096	WMIC.exe
Token: SeRestorePrivilege	5096	WMIC.exe
Token: SeShutdownPrivilege	5096	WMIC.exe
Token: SeDebugPrivilege	5096	WMIC.exe
Token: SeSystemEnvironmentPrivilege	5096	WMIC.exe
Token: SeRemoteShutdownPrivilege	5096	WMIC.exe
Token: SeUndockPrivilege	5096	WMIC.exe
Token: SeManageVolumePrivilege	5096	WMIC.exe
Token: 33	5096	WMIC.exe
Token: 34	5096	WMIC.exe
Token: 35	5096	WMIC.exe
Token: 36	5096	WMIC.exe
Token: SeIncreaseQuotaPrivilege	5096	WMIC.exe
Token: SeSecurityPrivilege	5096	WMIC.exe
Token: SeTakeOwnershipPrivilege	5096	WMIC.exe
Token: SeLoadDriverPrivilege	5096	WMIC.exe
Token: SeSystemProfilePrivilege	5096	WMIC.exe
Token: SeSystemtimePrivilege	5096	WMIC.exe
Token: SeProfSingleProcessPrivilege	5096	WMIC.exe
Token: SeIncBasePriorityPrivilege	5096	WMIC.exe
Token: SeCreatePagefilePrivilege	5096	WMIC.exe
Token: SeBackupPrivilege	5096	WMIC.exe
Token: SeRestorePrivilege	5096	WMIC.exe
Token: SeShutdownPrivilege	5096	WMIC.exe
Token: SeDebugPrivilege	5096	WMIC.exe
Token: SeSystemEnvironmentPrivilege	5096	WMIC.exe
Token: SeRemoteShutdownPrivilege	5096	WMIC.exe
Token: SeUndockPrivilege	5096	WMIC.exe
Token: SeManageVolumePrivilege	5096	WMIC.exe
Token: 33	5096	WMIC.exe
Token: 34	5096	WMIC.exe
Token: 35	5096	WMIC.exe
Token: 36	5096	WMIC.exe
Token: SeIncreaseQuotaPrivilege	3300	WMIC.exe
Token: SeSecurityPrivilege	3300	WMIC.exe
Token: SeTakeOwnershipPrivilege	3300	WMIC.exe
Token: SeLoadDriverPrivilege	3300	WMIC.exe
Token: SeSystemProfilePrivilege	3300	WMIC.exe
Token: SeSystemtimePrivilege	3300	WMIC.exe
Token: SeProfSingleProcessPrivilege	3300	WMIC.exe
Token: SeIncBasePriorityPrivilege	3300	WMIC.exe
Token: SeCreatePagefilePrivilege	3300	WMIC.exe
Token: SeBackupPrivilege	3300	WMIC.exe
Token: SeRestorePrivilege	3300	WMIC.exe
Token: SeShutdownPrivilege	3300	WMIC.exe
Token: SeDebugPrivilege	3300	WMIC.exe
Token: SeSystemEnvironmentPrivilege	3300	WMIC.exe
Token: SeRemoteShutdownPrivilege	3300	WMIC.exe
Token: SeUndockPrivilege	3300	WMIC.exe
Token: SeManageVolumePrivilege	3300	WMIC.exe
Token: 33	3300	WMIC.exe
Token: 34	3300	WMIC.exe
Token: 35	3300	WMIC.exe
Token: 36	3300	WMIC.exe
Token: SeIncreaseQuotaPrivilege	3300	WMIC.exe

Suspicious use of WriteProcessMemory 12 IoCs

description	pid	Process	procid_target
PID 1496 wrote to memory of 5096	1496	cmd.exe	84
PID 1496 wrote to memory of 5096	1496	cmd.exe	84
PID 1496 wrote to memory of 3300	1496	cmd.exe	86
PID 1496 wrote to memory of 3300	1496	cmd.exe	86
PID 1496 wrote to memory of 1452	1496	cmd.exe	87
PID 1496 wrote to memory of 1452	1496	cmd.exe	87
PID 1496 wrote to memory of 3412	1496	cmd.exe	88
PID 1496 wrote to memory of 3412	1496	cmd.exe	88
PID 1496 wrote to memory of 4208	1496	cmd.exe	89
PID 1496 wrote to memory of 4208	1496	cmd.exe	89
PID 1496 wrote to memory of 2472	1496	cmd.exe	90
PID 1496 wrote to memory of 2472	1496	cmd.exe	90

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\perm\serials\SerialsChecker.bat"
1⤵
- Suspicious use of WriteProcessMemory
PID:1496
- C:\Windows\System32\Wbem\WMIC.exe
  wmic bios get serialnumber
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  PID:5096
- C:\Windows\System32\Wbem\WMIC.exe
  wmic csproduct get uuid
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  PID:3300
- C:\Windows\System32\Wbem\WMIC.exe
  wmic diskdrive get serialnumber
  2⤵
  PID:1452
- C:\Windows\System32\Wbem\WMIC.exe
  wmic baseboard get serialnumber
  2⤵
  PID:3412
- C:\Windows\System32\Wbem\WMIC.exe
  wmic baseboard get manufacturer
  2⤵
  PID:4208
- C:\Windows\System32\Wbem\WMIC.exe
  wmic path Win32_NetworkAdapter where "PNPDeviceID like '%PCI%' AND NetConnectionStatus=2 AND AdapterTypeID='0'" get MacAddress
  2⤵
  PID:2472

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads