File name: | chicken_2_better.bat |
Full analysis: | https://app.any.run/tasks/c72f5c57-4cc2-4a01-953e-0980ec788f23 |
Verdict: | Malicious activity |
Analysis date: | November 29, 2020, 16:20:33 |
OS: | Windows 7 Professional Service Pack 1 (build: 7601, 32 bit) |
Indicators: | |
MIME: | text/x-msdos-batch |
File info: | DOS batch file, UTF-8 Unicode text, with CRLF line terminators |
MD5: | BC2E5305708D2380C84D10EEAF5C86C3 |
SHA1: | 7A4ACC804D9B48A63EE462368AA4DADB3846A805 |
SHA256: | 4D56018213E932184CA663CA2B32668BC6303497BE2D7AC991100A8EF48FBB58 |
SSDEEP: | 12:wIfd+6gurWxL3W8d6bDWs3fWyOWrEJfmW7MWaWYkG4AYSr20GsXE6Bd:bgu8S/KSE9mCMWa7kG4AYSAs06L |
PID | CMD | Path | Indicators | Parent process |
---|---|---|---|---|
2908 | cmd /c ""C:\Users\admin\AppData\Local\Temp\chicken_2_better.bat" " | C:\Windows\system32\cmd.exe | — | explorer.exe |
User: admin Company: Microsoft Corporation Integrity Level: MEDIUM Description: Windows Command Processor Exit code: 1 Version: 6.1.7601.17514 (win7sp1_rtm.101119-1850) | ||||
332 | ping localhost -n 4 | C:\Windows\system32\PING.EXE | — | cmd.exe |
User: admin Company: Microsoft Corporation Integrity Level: MEDIUM Description: TCP/IP Ping Command Exit code: 0 Version: 6.1.7600.16385 (win7_rtm.090713-1255) | ||||
2620 | ping localhost -n 4 | C:\Windows\system32\PING.EXE | — | cmd.exe |
User: admin Company: Microsoft Corporation Integrity Level: MEDIUM Description: TCP/IP Ping Command Exit code: 0 Version: 6.1.7600.16385 (win7_rtm.090713-1255) | ||||
2752 | ping localhost -n 4 | C:\Windows\system32\PING.EXE | — | cmd.exe |
User: admin Company: Microsoft Corporation Integrity Level: MEDIUM Description: TCP/IP Ping Command Exit code: 0 Version: 6.1.7600.16385 (win7_rtm.090713-1255) | ||||
1360 | ping localhost -n 3 | C:\Windows\system32\PING.EXE | — | cmd.exe |
User: admin Company: Microsoft Corporation Integrity Level: MEDIUM Description: TCP/IP Ping Command Exit code: 0 Version: 6.1.7600.16385 (win7_rtm.090713-1255) | ||||
1100 | taskkill /f /im explorer.exe | C:\Windows\system32\taskkill.exe | — | cmd.exe |
User: admin Company: Microsoft Corporation Integrity Level: MEDIUM Description: Terminates Processes Exit code: 0 Version: 6.1.7600.16385 (win7_rtm.090713-1255) | ||||
2884 | taskkill /f /im taskmgr.exe | C:\Windows\system32\taskkill.exe | — | cmd.exe |
User: admin Company: Microsoft Corporation Integrity Level: MEDIUM Description: Terminates Processes Exit code: 128 Version: 6.1.7600.16385 (win7_rtm.090713-1255) | ||||
3616 | taskkill /f /im discord.exe | C:\Windows\system32\taskkill.exe | — | cmd.exe |
User: admin Company: Microsoft Corporation Integrity Level: MEDIUM Description: Terminates Processes Exit code: 128 Version: 6.1.7600.16385 (win7_rtm.090713-1255) | ||||
2812 | taskkill /f /im firefox.exe | C:\Windows\system32\taskkill.exe | — | cmd.exe |
User: admin Company: Microsoft Corporation Integrity Level: MEDIUM Description: Terminates Processes Exit code: 128 Version: 6.1.7600.16385 (win7_rtm.090713-1255) | ||||
336 | shutdown /f /t 600 | C:\Windows\system32\shutdown.exe | — | cmd.exe |
User: admin Company: Microsoft Corporation Integrity Level: MEDIUM Description: Windows Shutdown and Annotation Tool Exit code: 1 Version: 6.1.7600.16385 (win7_rtm.090713-1255) |