3460bddb22bbd2c03da5dbcc68e6ce1d54cfb1d5991196eff039acb093d96307 | Triage™

Analysis

max time kernel
113s
max time network
119s
platform
windows7_x64
resource
win7
submitted
05/08/2020, 07:54

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
SHRIKESH_CHALLAN.cmd.exe
Size 632KB
Sample200805-72cdtjalvs
SHA256 3460bddb22bbd2c03da5dbcc68e6ce1d54cfb1d5991196eff039acb093d96307
MD5 528c884771ee6d21e05a993ad7deb16b
SHA1 0fca8a203177c6cbbe718735a3aa726d32f677a3
SHA512 d7099d891feabfcc4576e024fe6deb651730282f14144106fce0b989679d65a3acf55594a675d27423ad237b94ad98712049a953cf3f8275a65892667de5f63c
MD5 SHA1 SHA512

Score

1^/10

Malware Config

Signatures

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
1540	DllHost.exe

Suspicious use of SetWindowsHookEx 3 IoCs

pid	Process
1440	SHRIKESH_CHALLAN.cmd.exe
1440	SHRIKESH_CHALLAN.cmd.exe
1440	SHRIKESH_CHALLAN.cmd.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1440 wrote to memory of 748	1440	SHRIKESH_CHALLAN.cmd.exe	25
PID 1440 wrote to memory of 748	1440	SHRIKESH_CHALLAN.cmd.exe	25
PID 1440 wrote to memory of 748	1440	SHRIKESH_CHALLAN.cmd.exe	25
PID 1440 wrote to memory of 748	1440	SHRIKESH_CHALLAN.cmd.exe	25

C:\Users\Admin\AppData\Local\Temp\SHRIKESH_CHALLAN.cmd.exe
"C:\Users\Admin\AppData\Local\Temp\SHRIKESH_CHALLAN.cmd.exe"
1⤵
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1440
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c C:\Users\Admin\AppData\Local\Temp\RECEIPT.bmp
  2⤵
  PID:748

C:\Windows\SysWOW64\DllHost.exe
C:\Windows\SysWOW64\DllHost.exe /Processid:{76D0CB12-7604-4048-B83C-1005C7DDC503}
1⤵
- Suspicious use of FindShellTrayWindow
PID:1540

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads