33bea9bd56f58000c389dc296d9d5a38f2074fe13bdeaa6dbe43f68ba677c837 | Triage

Analysis

max time kernel
2s
max time network
54s
platform
windows7_x64
resource
win7v20210410
submitted
06-07-2021 18:55

Sharing

Report Analysis Logs

General

Target

HWUpgradeScripts/PreConfigureWindows7SourcePC.bat
Size

983B
MD5

81307c4fae02336dd550c4662f880dea
SHA1

29c0417e3e305e6f42461dedb9d9449cfcfe15d5
SHA256

92654778a60ba89d61c85e437a6649bd3e56c2c0fa49826ef6a1da4289c724b1
SHA512

325f67d47fb11dc62e7b5c729c86e30454a90da672e2b3a51114346037c9c64387209ed581ccaef30edf8736a036d16aa68c016f43c4d5579ddb2b99d7c6c530

Score

1^/10

Malware Config

Signatures

Suspicious use of WriteProcessMemory 15 IoCs

Processes:

cmd.exe

description	pid	process	target process
PID 1620 wrote to memory of 2016	1620	cmd.exe	cmd.exe
PID 1620 wrote to memory of 2016	1620	cmd.exe	cmd.exe
PID 1620 wrote to memory of 2016	1620	cmd.exe	cmd.exe
PID 1620 wrote to memory of 1192	1620	cmd.exe	findstr.exe
PID 1620 wrote to memory of 1192	1620	cmd.exe	findstr.exe
PID 1620 wrote to memory of 1192	1620	cmd.exe	findstr.exe
PID 1620 wrote to memory of 1220	1620	cmd.exe	cmd.exe
PID 1620 wrote to memory of 1220	1620	cmd.exe	cmd.exe
PID 1620 wrote to memory of 1220	1620	cmd.exe	cmd.exe
PID 1620 wrote to memory of 1260	1620	cmd.exe	findstr.exe
PID 1620 wrote to memory of 1260	1620	cmd.exe	findstr.exe
PID 1620 wrote to memory of 1260	1620	cmd.exe	findstr.exe
PID 1620 wrote to memory of 1328	1620	cmd.exe	reg.exe
PID 1620 wrote to memory of 1328	1620	cmd.exe	reg.exe
PID 1620 wrote to memory of 1328	1620	cmd.exe	reg.exe

C:\Windows\system32\cmd.exe
cmd /c "C:\Users\Admin\AppData\Local\Temp\HWUpgradeScripts\PreConfigureWindows7SourcePC.bat"
1⤵
- Suspicious use of WriteProcessMemory
PID:1620

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /S /D /c" ver "
2⤵
PID:2016

C:\Windows\system32\findstr.exe
findstr /i "5\.1\."
2⤵
PID:1192

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /S /D /c" ver "
2⤵
PID:1220

C:\Windows\system32\findstr.exe
findstr /i "6\.1\."
2⤵
PID:1260

C:\Windows\system32\reg.exe
REG QUERY HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA
2⤵
PID:1328

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1192-61-0x0000000000000000-mapping.dmp

Download
memory/1220-62-0x0000000000000000-mapping.dmp

Download
memory/1260-63-0x0000000000000000-mapping.dmp

Download
memory/1328-64-0x0000000000000000-mapping.dmp

Download
memory/2016-60-0x0000000000000000-mapping.dmp

Download