Analysis
-
max time kernel
1s -
max time network
19s -
platform
windows7_x64 -
resource
win7-20250207-en -
resource tags
arch:x64arch:x86image:win7-20250207-enlocale:en-usos:windows7-x64system -
submitted
10/03/2025, 18:22
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
Guna.UI2.dll
Resource
win7-20240903-en
windows7-x64
0 signatures
150 seconds
Behavioral task
behavioral2
Sample
Guna.UI2.dll
Resource
win10v2004-20250217-en
windows10-2004-x64
0 signatures
150 seconds
Behavioral task
behavioral3
Sample
cleaner.bat
Resource
win7-20240903-en
windows7-x64
6 signatures
150 seconds
Behavioral task
behavioral4
Sample
cleaner.bat
Resource
win10v2004-20250217-en
windows10-2004-x64
6 signatures
150 seconds
Behavioral task
behavioral5
Sample
loader.exe
Resource
win7-20240903-en
windows7-x64
16 signatures
150 seconds
Behavioral task
behavioral6
Sample
loader.exe
Resource
win10v2004-20250217-en
windows10-2004-x64
15 signatures
150 seconds
Behavioral task
behavioral7
Sample
mac.bat
Resource
win7-20250207-en
windows7-x64
3 signatures
150 seconds
Behavioral task
behavioral8
Sample
mac.bat
Resource
win10v2004-20250217-en
windows10-2004-x64
3 signatures
150 seconds
General
-
Target
mac.bat
-
Size
2KB
-
MD5
86630f471a1c7f40e8494347f9ab8249
-
SHA1
10a2139adfb884f01799de89bf9b9ccb2a8bb460
-
SHA256
c15faade0e71acd4abcb60a7e9f3f002a46d3d47bd294f7b12d811c871d1292c
-
SHA512
666fe7866c2bedc78aad081bddf7e4dc8a9038b173527dc9464dd9c0776314a8c3e1ec7f4d0f34aff0d946b94ed1178a5c665d79173d1bfe0a0a611f6af65369
Score
3/10
Malware Config
Signatures
-
Event Triggered Execution: Netsh Helper DLL 1 TTPs 3 IoCs
Netsh.exe (also referred to as Netshell) is a command-line scripting utility used to interact with the network configuration of a system.
description ioc Process Key opened \REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh netsh.exe Key queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh netsh.exe Key value enumerated \REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh netsh.exe -
Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeIncreaseQuotaPrivilege 3020 WMIC.exe Token: SeSecurityPrivilege 3020 WMIC.exe Token: SeTakeOwnershipPrivilege 3020 WMIC.exe Token: SeLoadDriverPrivilege 3020 WMIC.exe Token: SeSystemProfilePrivilege 3020 WMIC.exe Token: SeSystemtimePrivilege 3020 WMIC.exe Token: SeProfSingleProcessPrivilege 3020 WMIC.exe Token: SeIncBasePriorityPrivilege 3020 WMIC.exe Token: SeCreatePagefilePrivilege 3020 WMIC.exe Token: SeBackupPrivilege 3020 WMIC.exe Token: SeRestorePrivilege 3020 WMIC.exe Token: SeShutdownPrivilege 3020 WMIC.exe Token: SeDebugPrivilege 3020 WMIC.exe Token: SeSystemEnvironmentPrivilege 3020 WMIC.exe Token: SeRemoteShutdownPrivilege 3020 WMIC.exe Token: SeUndockPrivilege 3020 WMIC.exe Token: SeManageVolumePrivilege 3020 WMIC.exe Token: 33 3020 WMIC.exe Token: 34 3020 WMIC.exe Token: 35 3020 WMIC.exe Token: SeIncreaseQuotaPrivilege 3020 WMIC.exe Token: SeSecurityPrivilege 3020 WMIC.exe Token: SeTakeOwnershipPrivilege 3020 WMIC.exe Token: SeLoadDriverPrivilege 3020 WMIC.exe Token: SeSystemProfilePrivilege 3020 WMIC.exe Token: SeSystemtimePrivilege 3020 WMIC.exe Token: SeProfSingleProcessPrivilege 3020 WMIC.exe Token: SeIncBasePriorityPrivilege 3020 WMIC.exe Token: SeCreatePagefilePrivilege 3020 WMIC.exe Token: SeBackupPrivilege 3020 WMIC.exe Token: SeRestorePrivilege 3020 WMIC.exe Token: SeShutdownPrivilege 3020 WMIC.exe Token: SeDebugPrivilege 3020 WMIC.exe Token: SeSystemEnvironmentPrivilege 3020 WMIC.exe Token: SeRemoteShutdownPrivilege 3020 WMIC.exe Token: SeUndockPrivilege 3020 WMIC.exe Token: SeManageVolumePrivilege 3020 WMIC.exe Token: 33 3020 WMIC.exe Token: 34 3020 WMIC.exe Token: 35 3020 WMIC.exe Token: SeIncreaseQuotaPrivilege 2120 WMIC.exe Token: SeSecurityPrivilege 2120 WMIC.exe Token: SeTakeOwnershipPrivilege 2120 WMIC.exe Token: SeLoadDriverPrivilege 2120 WMIC.exe Token: SeSystemProfilePrivilege 2120 WMIC.exe Token: SeSystemtimePrivilege 2120 WMIC.exe Token: SeProfSingleProcessPrivilege 2120 WMIC.exe Token: SeIncBasePriorityPrivilege 2120 WMIC.exe Token: SeCreatePagefilePrivilege 2120 WMIC.exe Token: SeBackupPrivilege 2120 WMIC.exe Token: SeRestorePrivilege 2120 WMIC.exe Token: SeShutdownPrivilege 2120 WMIC.exe Token: SeDebugPrivilege 2120 WMIC.exe Token: SeSystemEnvironmentPrivilege 2120 WMIC.exe Token: SeRemoteShutdownPrivilege 2120 WMIC.exe Token: SeUndockPrivilege 2120 WMIC.exe Token: SeManageVolumePrivilege 2120 WMIC.exe Token: 33 2120 WMIC.exe Token: 34 2120 WMIC.exe Token: 35 2120 WMIC.exe Token: SeIncreaseQuotaPrivilege 2120 WMIC.exe Token: SeSecurityPrivilege 2120 WMIC.exe Token: SeTakeOwnershipPrivilege 2120 WMIC.exe Token: SeLoadDriverPrivilege 2120 WMIC.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2220 wrote to memory of 2416 2220 cmd.exe 31 PID 2220 wrote to memory of 2416 2220 cmd.exe 31 PID 2220 wrote to memory of 2416 2220 cmd.exe 31 PID 2416 wrote to memory of 3020 2416 cmd.exe 32 PID 2416 wrote to memory of 3020 2416 cmd.exe 32 PID 2416 wrote to memory of 3020 2416 cmd.exe 32 PID 2416 wrote to memory of 2768 2416 cmd.exe 33 PID 2416 wrote to memory of 2768 2416 cmd.exe 33 PID 2416 wrote to memory of 2768 2416 cmd.exe 33 PID 2220 wrote to memory of 2964 2220 cmd.exe 35 PID 2220 wrote to memory of 2964 2220 cmd.exe 35 PID 2220 wrote to memory of 2964 2220 cmd.exe 35 PID 2220 wrote to memory of 2376 2220 cmd.exe 36 PID 2220 wrote to memory of 2376 2220 cmd.exe 36 PID 2220 wrote to memory of 2376 2220 cmd.exe 36 PID 2220 wrote to memory of 3012 2220 cmd.exe 37 PID 2220 wrote to memory of 3012 2220 cmd.exe 37 PID 2220 wrote to memory of 3012 2220 cmd.exe 37 PID 2220 wrote to memory of 2568 2220 cmd.exe 38 PID 2220 wrote to memory of 2568 2220 cmd.exe 38 PID 2220 wrote to memory of 2568 2220 cmd.exe 38 PID 2220 wrote to memory of 2780 2220 cmd.exe 39 PID 2220 wrote to memory of 2780 2220 cmd.exe 39 PID 2220 wrote to memory of 2780 2220 cmd.exe 39 PID 2780 wrote to memory of 2120 2780 cmd.exe 40 PID 2780 wrote to memory of 2120 2780 cmd.exe 40 PID 2780 wrote to memory of 2120 2780 cmd.exe 40 PID 2780 wrote to memory of 2064 2780 cmd.exe 41 PID 2780 wrote to memory of 2064 2780 cmd.exe 41 PID 2780 wrote to memory of 2064 2780 cmd.exe 41 PID 2220 wrote to memory of 2884 2220 cmd.exe 42 PID 2220 wrote to memory of 2884 2220 cmd.exe 42 PID 2220 wrote to memory of 2884 2220 cmd.exe 42 PID 2220 wrote to memory of 2900 2220 cmd.exe 43 PID 2220 wrote to memory of 2900 2220 cmd.exe 43 PID 2220 wrote to memory of 2900 2220 cmd.exe 43 PID 2220 wrote to memory of 2936 2220 cmd.exe 44 PID 2220 wrote to memory of 2936 2220 cmd.exe 44 PID 2220 wrote to memory of 2936 2220 cmd.exe 44 PID 2220 wrote to memory of 2948 2220 cmd.exe 45 PID 2220 wrote to memory of 2948 2220 cmd.exe 45 PID 2220 wrote to memory of 2948 2220 cmd.exe 45 PID 2220 wrote to memory of 3044 2220 cmd.exe 46 PID 2220 wrote to memory of 3044 2220 cmd.exe 46 PID 2220 wrote to memory of 3044 2220 cmd.exe 46 PID 3044 wrote to memory of 2840 3044 cmd.exe 47 PID 3044 wrote to memory of 2840 3044 cmd.exe 47 PID 3044 wrote to memory of 2840 3044 cmd.exe 47 PID 2220 wrote to memory of 2804 2220 cmd.exe 48 PID 2220 wrote to memory of 2804 2220 cmd.exe 48 PID 2220 wrote to memory of 2804 2220 cmd.exe 48 PID 2220 wrote to memory of 2416 2220 cmd.exe 31 PID 2220 wrote to memory of 2416 2220 cmd.exe 31 PID 2220 wrote to memory of 2416 2220 cmd.exe 31 PID 2416 wrote to memory of 3020 2416 cmd.exe 32 PID 2416 wrote to memory of 3020 2416 cmd.exe 32 PID 2416 wrote to memory of 3020 2416 cmd.exe 32 PID 2416 wrote to memory of 2768 2416 cmd.exe 33 PID 2416 wrote to memory of 2768 2416 cmd.exe 33 PID 2416 wrote to memory of 2768 2416 cmd.exe 33 PID 2220 wrote to memory of 2964 2220 cmd.exe 35 PID 2220 wrote to memory of 2964 2220 cmd.exe 35 PID 2220 wrote to memory of 2964 2220 cmd.exe 35 PID 2220 wrote to memory of 2376 2220 cmd.exe 36
Processes
-
C:\Windows\system32\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\mac.bat"1⤵
- Suspicious use of WriteProcessMemory
PID:2220 -
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic nic where physicaladapter=true get deviceid | findstr [0-9]2⤵
- Suspicious use of WriteProcessMemory
PID:2416 -
C:\Windows\System32\Wbem\WMIC.exewmic nic where physicaladapter=true get deviceid3⤵
- Suspicious use of AdjustPrivilegeToken
PID:3020
-
-
C:\Windows\system32\findstr.exefindstr [0-9]3⤵PID:2768
-
-
-
C:\Windows\system32\reg.exeREG QUERY HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Class\{4D36E972-E325-11CE-BFC1-08002bE10318}\072⤵PID:2964
-
-
C:\Windows\system32\reg.exeREG QUERY HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Class\{4D36E972-E325-11CE-BFC1-08002bE10318}\0072⤵PID:2376
-
-
C:\Windows\system32\reg.exeREG QUERY HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Class\{4D36E972-E325-11CE-BFC1-08002bE10318}\00072⤵PID:3012
-
-
C:\Windows\system32\reg.exeREG ADD HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Class\{4D36E972-E325-11CE-BFC1-08002bE10318}\0007 /v NetworkAddress /t REG_SZ /d 3EC418C8B822 /f2⤵PID:2568
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic nic where physicaladapter=true get deviceid | findstr [0-9]2⤵
- Suspicious use of WriteProcessMemory
PID:2780 -
C:\Windows\System32\Wbem\WMIC.exewmic nic where physicaladapter=true get deviceid3⤵
- Suspicious use of AdjustPrivilegeToken
PID:2120
-
-
C:\Windows\system32\findstr.exefindstr [0-9]3⤵PID:2064
-
-
-
C:\Windows\system32\reg.exeREG QUERY HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Class\{4D36E972-E325-11CE-BFC1-08002bE10318}\072⤵PID:2884
-
-
C:\Windows\system32\reg.exeREG QUERY HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Class\{4D36E972-E325-11CE-BFC1-08002bE10318}\0072⤵PID:2900
-
-
C:\Windows\system32\reg.exeREG QUERY HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Class\{4D36E972-E325-11CE-BFC1-08002bE10318}\00072⤵PID:2936
-
-
C:\Windows\system32\reg.exeREG ADD HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Class\{4D36E972-E325-11CE-BFC1-08002bE10318}\0007 /v PnPCapabilities /t REG_DWORD /d 24 /f2⤵PID:2948
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "wmic nic where (netconnectionid like '%') get netconnectionid,netconnectionstatus /format:csv"2⤵
- Suspicious use of WriteProcessMemory
PID:3044 -
C:\Windows\System32\Wbem\WMIC.exewmic nic where (netconnectionid like '%') get netconnectionid,netconnectionstatus /format:csv3⤵PID:2840
-
-
-
C:\Windows\system32\netsh.exenetsh interface set interface name="Local Area Connection" disable2⤵
- Event Triggered Execution: Netsh Helper DLL
PID:2804
-