Analysis
- max time kernel
149s - max time network
104s - platform
windows11-21h2_x64 - resource
win11-20250610-en - resource tags
arch:x64arch:x86image:win11-20250610-enlocale:en-usos:windows11-21h2-x64system - submitted
09/11/2025, 03:51
Static task
static1
Behavioral task
behavioral1
Sample
upx.bat
Resource
win10v2004-20251016-en
windows10-2004-x64
2 signatures
150 seconds
Behavioral task
behavioral2
Sample
upx.bat
Resource
win11-20250610-en
windows11-21h2-x64
2 signatures
150 seconds
General
- Target upx.bat
- Size 6.7MB
- Sample251109-eelakabl8w
- SHA256 f7433ed3022e4e54d0e81e352c18a2f96e3722dddcec3f1971a3f443ca6befd0
- MD5 e71198c9d343ad99fce38b58056f3d67
- SHA1 a50acb34a9ee758de5dfccaa097f3b8a5af7e5ba
- SHA512 61a76b4d93c54812a247e73d84951b8c635963783b009dcd6ec54a0d39067013b469cadb86093d3527edf65302f664a0c9e4c6306ec391a32b2ec0bfd644e087
- SSDEEP 49152:+gf49T8MCkXd8OVRSZS0Mo5YVLHb/B3dHybHeOKX6xSnpTlur8ciNO3IOUw+YCUK:A
- MD5 SHA1 SHA512 SSDEEP
Score
1/10
Malware Config
Signatures
- Suspicious use of AdjustPrivilegeToken 42 IoCs
description pid Process Token: SeIncreaseQuotaPrivilege 1784 WMIC.exe Token: SeSecurityPrivilege 1784 WMIC.exe Token: SeTakeOwnershipPrivilege 1784 WMIC.exe Token: SeLoadDriverPrivilege 1784 WMIC.exe Token: SeSystemProfilePrivilege 1784 WMIC.exe Token: SeSystemtimePrivilege 1784 WMIC.exe Token: SeProfSingleProcessPrivilege 1784 WMIC.exe Token: SeIncBasePriorityPrivilege 1784 WMIC.exe Token: SeCreatePagefilePrivilege 1784 WMIC.exe Token: SeBackupPrivilege 1784 WMIC.exe Token: SeRestorePrivilege 1784 WMIC.exe Token: SeShutdownPrivilege 1784 WMIC.exe Token: SeDebugPrivilege 1784 WMIC.exe Token: SeSystemEnvironmentPrivilege 1784 WMIC.exe Token: SeRemoteShutdownPrivilege 1784 WMIC.exe Token: SeUndockPrivilege 1784 WMIC.exe Token: SeManageVolumePrivilege 1784 WMIC.exe Token: 33 1784 WMIC.exe Token: 34 1784 WMIC.exe Token: 35 1784 WMIC.exe Token: 36 1784 WMIC.exe Token: SeIncreaseQuotaPrivilege 1784 WMIC.exe Token: SeSecurityPrivilege 1784 WMIC.exe Token: SeTakeOwnershipPrivilege 1784 WMIC.exe Token: SeLoadDriverPrivilege 1784 WMIC.exe Token: SeSystemProfilePrivilege 1784 WMIC.exe Token: SeSystemtimePrivilege 1784 WMIC.exe Token: SeProfSingleProcessPrivilege 1784 WMIC.exe Token: SeIncBasePriorityPrivilege 1784 WMIC.exe Token: SeCreatePagefilePrivilege 1784 WMIC.exe Token: SeBackupPrivilege 1784 WMIC.exe Token: SeRestorePrivilege 1784 WMIC.exe Token: SeShutdownPrivilege 1784 WMIC.exe Token: SeDebugPrivilege 1784 WMIC.exe Token: SeSystemEnvironmentPrivilege 1784 WMIC.exe Token: SeRemoteShutdownPrivilege 1784 WMIC.exe Token: SeUndockPrivilege 1784 WMIC.exe Token: SeManageVolumePrivilege 1784 WMIC.exe Token: 33 1784 WMIC.exe Token: 34 1784 WMIC.exe Token: 35 1784 WMIC.exe Token: 36 1784 WMIC.exe - Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 760 wrote to memory of 1784 760 cmd.exe 79 PID 760 wrote to memory of 1784 760 cmd.exe 79 PID 760 wrote to memory of 1524 760 cmd.exe 80 PID 760 wrote to memory of 1524 760 cmd.exe 80
Processes
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\upx.bat"1⤵
- Suspicious use of WriteProcessMemory
PID:760 -
C:\Windows\System32\Wbem\WMIC.exewmic diskdrive get Model2⤵
- Suspicious use of AdjustPrivilegeToken
PID:1784
-
-
C:\Windows\system32\findstr.exefindstr /i /c:"WDS100T2B0A" /c:"QEMU HARDDISK" /c:"DADY HARDDISK"2⤵PID:1524
-