Analysis
-
max time kernel
0s -
max time network
129s -
platform
windows10-2004_x64 -
resource
win10v2004-20250217-en -
resource tags
arch:x64arch:x86image:win10v2004-20250217-enlocale:en-usos:windows10-2004-x64system -
submitted
10/03/2025, 18:41
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
Guna.UI2.dll
Resource
win7-20240903-en
windows7-x64
0 signatures
150 seconds
Behavioral task
behavioral2
Sample
Guna.UI2.dll
Resource
win10v2004-20250217-en
windows10-2004-x64
0 signatures
150 seconds
Behavioral task
behavioral3
Sample
cleaner.bat
Resource
win7-20240903-en
windows7-x64
6 signatures
150 seconds
Behavioral task
behavioral4
Sample
cleaner.bat
Resource
win10v2004-20250217-en
windows10-2004-x64
6 signatures
150 seconds
Behavioral task
behavioral5
Sample
loader.exe
Resource
win7-20241010-en
windows7-x64
15 signatures
150 seconds
Behavioral task
behavioral6
Sample
loader.exe
Resource
win10v2004-20250217-en
windows10-2004-x64
15 signatures
150 seconds
Behavioral task
behavioral7
Sample
mac.bat
Resource
win7-20240903-en
windows7-x64
3 signatures
150 seconds
Behavioral task
behavioral8
Sample
mac.bat
Resource
win10v2004-20250217-en
windows10-2004-x64
2 signatures
150 seconds
General
-
Target
mac.bat
-
Size
2KB
-
MD5
86630f471a1c7f40e8494347f9ab8249
-
SHA1
10a2139adfb884f01799de89bf9b9ccb2a8bb460
-
SHA256
c15faade0e71acd4abcb60a7e9f3f002a46d3d47bd294f7b12d811c871d1292c
-
SHA512
666fe7866c2bedc78aad081bddf7e4dc8a9038b173527dc9464dd9c0776314a8c3e1ec7f4d0f34aff0d946b94ed1178a5c665d79173d1bfe0a0a611f6af65369
Score
1/10
Malware Config
Signatures
-
Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeIncreaseQuotaPrivilege 5012 WMIC.exe Token: SeSecurityPrivilege 5012 WMIC.exe Token: SeTakeOwnershipPrivilege 5012 WMIC.exe Token: SeLoadDriverPrivilege 5012 WMIC.exe Token: SeSystemProfilePrivilege 5012 WMIC.exe Token: SeSystemtimePrivilege 5012 WMIC.exe Token: SeProfSingleProcessPrivilege 5012 WMIC.exe Token: SeIncBasePriorityPrivilege 5012 WMIC.exe Token: SeCreatePagefilePrivilege 5012 WMIC.exe Token: SeBackupPrivilege 5012 WMIC.exe Token: SeRestorePrivilege 5012 WMIC.exe Token: SeShutdownPrivilege 5012 WMIC.exe Token: SeDebugPrivilege 5012 WMIC.exe Token: SeSystemEnvironmentPrivilege 5012 WMIC.exe Token: SeRemoteShutdownPrivilege 5012 WMIC.exe Token: SeUndockPrivilege 5012 WMIC.exe Token: SeManageVolumePrivilege 5012 WMIC.exe Token: 33 5012 WMIC.exe Token: 34 5012 WMIC.exe Token: 35 5012 WMIC.exe Token: 36 5012 WMIC.exe Token: SeIncreaseQuotaPrivilege 5012 WMIC.exe Token: SeSecurityPrivilege 5012 WMIC.exe Token: SeTakeOwnershipPrivilege 5012 WMIC.exe Token: SeLoadDriverPrivilege 5012 WMIC.exe Token: SeSystemProfilePrivilege 5012 WMIC.exe Token: SeSystemtimePrivilege 5012 WMIC.exe Token: SeProfSingleProcessPrivilege 5012 WMIC.exe Token: SeIncBasePriorityPrivilege 5012 WMIC.exe Token: SeCreatePagefilePrivilege 5012 WMIC.exe Token: SeBackupPrivilege 5012 WMIC.exe Token: SeRestorePrivilege 5012 WMIC.exe Token: SeShutdownPrivilege 5012 WMIC.exe Token: SeDebugPrivilege 5012 WMIC.exe Token: SeSystemEnvironmentPrivilege 5012 WMIC.exe Token: SeRemoteShutdownPrivilege 5012 WMIC.exe Token: SeUndockPrivilege 5012 WMIC.exe Token: SeManageVolumePrivilege 5012 WMIC.exe Token: 33 5012 WMIC.exe Token: 34 5012 WMIC.exe Token: 35 5012 WMIC.exe Token: 36 5012 WMIC.exe Token: SeIncreaseQuotaPrivilege 2264 WMIC.exe Token: SeSecurityPrivilege 2264 WMIC.exe Token: SeTakeOwnershipPrivilege 2264 WMIC.exe Token: SeLoadDriverPrivilege 2264 WMIC.exe Token: SeSystemProfilePrivilege 2264 WMIC.exe Token: SeSystemtimePrivilege 2264 WMIC.exe Token: SeProfSingleProcessPrivilege 2264 WMIC.exe Token: SeIncBasePriorityPrivilege 2264 WMIC.exe Token: SeCreatePagefilePrivilege 2264 WMIC.exe Token: SeBackupPrivilege 2264 WMIC.exe Token: SeRestorePrivilege 2264 WMIC.exe Token: SeShutdownPrivilege 2264 WMIC.exe Token: SeDebugPrivilege 2264 WMIC.exe Token: SeSystemEnvironmentPrivilege 2264 WMIC.exe Token: SeRemoteShutdownPrivilege 2264 WMIC.exe Token: SeUndockPrivilege 2264 WMIC.exe Token: SeManageVolumePrivilege 2264 WMIC.exe Token: 33 2264 WMIC.exe Token: 34 2264 WMIC.exe Token: 35 2264 WMIC.exe Token: 36 2264 WMIC.exe Token: SeIncreaseQuotaPrivilege 2264 WMIC.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 5052 wrote to memory of 1496 5052 cmd.exe 87 PID 5052 wrote to memory of 1496 5052 cmd.exe 87 PID 1496 wrote to memory of 5012 1496 cmd.exe 88 PID 1496 wrote to memory of 5012 1496 cmd.exe 88 PID 1496 wrote to memory of 4776 1496 cmd.exe 89 PID 1496 wrote to memory of 4776 1496 cmd.exe 89 PID 5052 wrote to memory of 2752 5052 cmd.exe 91 PID 5052 wrote to memory of 2752 5052 cmd.exe 91 PID 5052 wrote to memory of 5072 5052 cmd.exe 92 PID 5052 wrote to memory of 5072 5052 cmd.exe 92 PID 5052 wrote to memory of 4616 5052 cmd.exe 93 PID 5052 wrote to memory of 4616 5052 cmd.exe 93 PID 5052 wrote to memory of 4740 5052 cmd.exe 94 PID 5052 wrote to memory of 4740 5052 cmd.exe 94 PID 5052 wrote to memory of 2728 5052 cmd.exe 95 PID 5052 wrote to memory of 2728 5052 cmd.exe 95 PID 2728 wrote to memory of 2264 2728 cmd.exe 96 PID 2728 wrote to memory of 2264 2728 cmd.exe 96 PID 2728 wrote to memory of 3776 2728 cmd.exe 97 PID 2728 wrote to memory of 3776 2728 cmd.exe 97 PID 5052 wrote to memory of 2188 5052 cmd.exe 99 PID 5052 wrote to memory of 2188 5052 cmd.exe 99 PID 5052 wrote to memory of 3704 5052 cmd.exe 100 PID 5052 wrote to memory of 3704 5052 cmd.exe 100 PID 5052 wrote to memory of 2796 5052 cmd.exe 101 PID 5052 wrote to memory of 2796 5052 cmd.exe 101 PID 5052 wrote to memory of 2860 5052 cmd.exe 102 PID 5052 wrote to memory of 2860 5052 cmd.exe 102 PID 5052 wrote to memory of 3160 5052 cmd.exe 103 PID 5052 wrote to memory of 3160 5052 cmd.exe 103 PID 3160 wrote to memory of 3176 3160 cmd.exe 104 PID 3160 wrote to memory of 3176 3160 cmd.exe 104 PID 5052 wrote to memory of 1496 5052 cmd.exe 87 PID 5052 wrote to memory of 1496 5052 cmd.exe 87 PID 1496 wrote to memory of 5012 1496 cmd.exe 88 PID 1496 wrote to memory of 5012 1496 cmd.exe 88 PID 1496 wrote to memory of 4776 1496 cmd.exe 89 PID 1496 wrote to memory of 4776 1496 cmd.exe 89 PID 5052 wrote to memory of 2752 5052 cmd.exe 91 PID 5052 wrote to memory of 2752 5052 cmd.exe 91 PID 5052 wrote to memory of 5072 5052 cmd.exe 92 PID 5052 wrote to memory of 5072 5052 cmd.exe 92 PID 5052 wrote to memory of 4616 5052 cmd.exe 93 PID 5052 wrote to memory of 4616 5052 cmd.exe 93 PID 5052 wrote to memory of 4740 5052 cmd.exe 94 PID 5052 wrote to memory of 4740 5052 cmd.exe 94 PID 5052 wrote to memory of 2728 5052 cmd.exe 95 PID 5052 wrote to memory of 2728 5052 cmd.exe 95 PID 2728 wrote to memory of 2264 2728 cmd.exe 96 PID 2728 wrote to memory of 2264 2728 cmd.exe 96 PID 2728 wrote to memory of 3776 2728 cmd.exe 97 PID 2728 wrote to memory of 3776 2728 cmd.exe 97 PID 5052 wrote to memory of 2188 5052 cmd.exe 99 PID 5052 wrote to memory of 2188 5052 cmd.exe 99 PID 5052 wrote to memory of 3704 5052 cmd.exe 100 PID 5052 wrote to memory of 3704 5052 cmd.exe 100 PID 5052 wrote to memory of 2796 5052 cmd.exe 101 PID 5052 wrote to memory of 2796 5052 cmd.exe 101 PID 5052 wrote to memory of 2860 5052 cmd.exe 102 PID 5052 wrote to memory of 2860 5052 cmd.exe 102 PID 5052 wrote to memory of 3160 5052 cmd.exe 103 PID 5052 wrote to memory of 3160 5052 cmd.exe 103 PID 3160 wrote to memory of 3176 3160 cmd.exe 104 PID 3160 wrote to memory of 3176 3160 cmd.exe 104
Processes
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\mac.bat"1⤵
- Suspicious use of WriteProcessMemory
PID:5052 -
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic nic where physicaladapter=true get deviceid | findstr [0-9]2⤵
- Suspicious use of WriteProcessMemory
PID:1496 -
C:\Windows\System32\Wbem\WMIC.exewmic nic where physicaladapter=true get deviceid3⤵
- Suspicious use of AdjustPrivilegeToken
PID:5012
-
-
C:\Windows\system32\findstr.exefindstr [0-9]3⤵PID:4776
-
-
-
C:\Windows\system32\reg.exeREG QUERY HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Class\{4D36E972-E325-11CE-BFC1-08002bE10318}\012⤵PID:2752
-
-
C:\Windows\system32\reg.exeREG QUERY HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Class\{4D36E972-E325-11CE-BFC1-08002bE10318}\0012⤵PID:5072
-
-
C:\Windows\system32\reg.exeREG QUERY HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Class\{4D36E972-E325-11CE-BFC1-08002bE10318}\00012⤵PID:4616
-
-
C:\Windows\system32\reg.exeREG ADD HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Class\{4D36E972-E325-11CE-BFC1-08002bE10318}\0001 /v NetworkAddress /t REG_SZ /d 92B85120352E /f2⤵PID:4740
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic nic where physicaladapter=true get deviceid | findstr [0-9]2⤵
- Suspicious use of WriteProcessMemory
PID:2728 -
C:\Windows\System32\Wbem\WMIC.exewmic nic where physicaladapter=true get deviceid3⤵
- Suspicious use of AdjustPrivilegeToken
PID:2264
-
-
C:\Windows\system32\findstr.exefindstr [0-9]3⤵PID:3776
-
-
-
C:\Windows\system32\reg.exeREG QUERY HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Class\{4D36E972-E325-11CE-BFC1-08002bE10318}\012⤵PID:2188
-
-
C:\Windows\system32\reg.exeREG QUERY HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Class\{4D36E972-E325-11CE-BFC1-08002bE10318}\0012⤵PID:3704
-
-
C:\Windows\system32\reg.exeREG QUERY HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Class\{4D36E972-E325-11CE-BFC1-08002bE10318}\00012⤵PID:2796
-
-
C:\Windows\system32\reg.exeREG ADD HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Class\{4D36E972-E325-11CE-BFC1-08002bE10318}\0001 /v PnPCapabilities /t REG_DWORD /d 24 /f2⤵PID:2860
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "wmic nic where (netconnectionid like '%') get netconnectionid,netconnectionstatus /format:csv"2⤵
- Suspicious use of WriteProcessMemory
PID:3160 -
C:\Windows\System32\Wbem\WMIC.exewmic nic where (netconnectionid like '%') get netconnectionid,netconnectionstatus /format:csv3⤵PID:3176
-
-
-
C:\Windows\system32\netsh.exenetsh interface set interface name="Ethernet" disable2⤵PID:2308
-
-
C:\Windows\System32\svchost.exeC:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted -p -s Netman1⤵PID:3188