Analysis
- max time kernel
149s - max time network
134s - platform
windows10-2004_x64 - resource
win10v2004-20251016-en - resource tags
arch:x64arch:x86image:win10v2004-20251016-enlocale:en-usos:windows10-2004-x64system - submitted
09/11/2025, 03:51
Static task
static1
Behavioral task
behavioral1
Sample
upx.bat
Resource
win10v2004-20251016-en
windows10-2004-x64
2 signatures
150 seconds
Behavioral task
behavioral2
Sample
upx.bat
Resource
win11-20250610-en
windows11-21h2-x64
2 signatures
150 seconds
General
- Target upx.bat
- Size 6.7MB
- Sample251109-eelakabl8w
- SHA256 f7433ed3022e4e54d0e81e352c18a2f96e3722dddcec3f1971a3f443ca6befd0
- MD5 e71198c9d343ad99fce38b58056f3d67
- SHA1 a50acb34a9ee758de5dfccaa097f3b8a5af7e5ba
- SHA512 61a76b4d93c54812a247e73d84951b8c635963783b009dcd6ec54a0d39067013b469cadb86093d3527edf65302f664a0c9e4c6306ec391a32b2ec0bfd644e087
- SSDEEP 49152:+gf49T8MCkXd8OVRSZS0Mo5YVLHb/B3dHybHeOKX6xSnpTlur8ciNO3IOUw+YCUK:A
- MD5 SHA1 SHA512 SSDEEP
Score
1/10
Malware Config
Signatures
- Suspicious use of AdjustPrivilegeToken 42 IoCs
description pid Process Token: SeIncreaseQuotaPrivilege 3420 WMIC.exe Token: SeSecurityPrivilege 3420 WMIC.exe Token: SeTakeOwnershipPrivilege 3420 WMIC.exe Token: SeLoadDriverPrivilege 3420 WMIC.exe Token: SeSystemProfilePrivilege 3420 WMIC.exe Token: SeSystemtimePrivilege 3420 WMIC.exe Token: SeProfSingleProcessPrivilege 3420 WMIC.exe Token: SeIncBasePriorityPrivilege 3420 WMIC.exe Token: SeCreatePagefilePrivilege 3420 WMIC.exe Token: SeBackupPrivilege 3420 WMIC.exe Token: SeRestorePrivilege 3420 WMIC.exe Token: SeShutdownPrivilege 3420 WMIC.exe Token: SeDebugPrivilege 3420 WMIC.exe Token: SeSystemEnvironmentPrivilege 3420 WMIC.exe Token: SeRemoteShutdownPrivilege 3420 WMIC.exe Token: SeUndockPrivilege 3420 WMIC.exe Token: SeManageVolumePrivilege 3420 WMIC.exe Token: 33 3420 WMIC.exe Token: 34 3420 WMIC.exe Token: 35 3420 WMIC.exe Token: 36 3420 WMIC.exe Token: SeIncreaseQuotaPrivilege 3420 WMIC.exe Token: SeSecurityPrivilege 3420 WMIC.exe Token: SeTakeOwnershipPrivilege 3420 WMIC.exe Token: SeLoadDriverPrivilege 3420 WMIC.exe Token: SeSystemProfilePrivilege 3420 WMIC.exe Token: SeSystemtimePrivilege 3420 WMIC.exe Token: SeProfSingleProcessPrivilege 3420 WMIC.exe Token: SeIncBasePriorityPrivilege 3420 WMIC.exe Token: SeCreatePagefilePrivilege 3420 WMIC.exe Token: SeBackupPrivilege 3420 WMIC.exe Token: SeRestorePrivilege 3420 WMIC.exe Token: SeShutdownPrivilege 3420 WMIC.exe Token: SeDebugPrivilege 3420 WMIC.exe Token: SeSystemEnvironmentPrivilege 3420 WMIC.exe Token: SeRemoteShutdownPrivilege 3420 WMIC.exe Token: SeUndockPrivilege 3420 WMIC.exe Token: SeManageVolumePrivilege 3420 WMIC.exe Token: 33 3420 WMIC.exe Token: 34 3420 WMIC.exe Token: 35 3420 WMIC.exe Token: 36 3420 WMIC.exe - Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 972 wrote to memory of 3420 972 cmd.exe 85 PID 972 wrote to memory of 3420 972 cmd.exe 85 PID 972 wrote to memory of 4796 972 cmd.exe 86 PID 972 wrote to memory of 4796 972 cmd.exe 86
Processes
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\upx.bat"1⤵
- Suspicious use of WriteProcessMemory
PID:972 -
C:\Windows\System32\Wbem\WMIC.exewmic diskdrive get Model2⤵
- Suspicious use of AdjustPrivilegeToken
PID:3420
-
-
C:\Windows\system32\findstr.exefindstr /i /c:"WDS100T2B0A" /c:"QEMU HARDDISK" /c:"DADY HARDDISK"2⤵PID:4796
-