390405b92fc7a8de13b82bf8ce7797a0038c58a242081a1705988c0ff41e0f4c | Triage

Analysis

max time kernel
178s
max time network
191s
platform
windows10-2004_x64
resource
win10v2004-20220414-en
submitted
25-06-2022 18:07

Sharing

Report Analysis Logs

General

Target

390405b92fc7a8de13b82bf8ce7797a0038c58a242081a1705988c0ff41e0f4c.exe
Size

6.7MB
MD5

3fd2140199b02e55d9e8d5b632bfdc71
SHA1

fa1151afe1205c3c9ed2b1b0d90bef37b7e15acf
SHA256

390405b92fc7a8de13b82bf8ce7797a0038c58a242081a1705988c0ff41e0f4c
SHA512

af552357c03c8c72d928463cd897424e9284f579746f5a3db13428709b2787ca076267cbca4c20d28d65a6fae226b02cb6ca7fff9872610788bb06ccf592dd11

Score

7^/10

Malware Config

Signatures

Drops startup file 2 IoCs

Processes:

cmd.exe

description	ioc	process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\svchostsw.exe	cmd.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\svchostsw.exe	cmd.exe

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

390405b92fc7a8de13b82bf8ce7797a0038c58a242081a1705988c0ff41e0f4c.exe

description	pid	process	target process
PID 3856 wrote to memory of 2380	3856	390405b92fc7a8de13b82bf8ce7797a0038c58a242081a1705988c0ff41e0f4c.exe	cmd.exe
PID 3856 wrote to memory of 2380	3856	390405b92fc7a8de13b82bf8ce7797a0038c58a242081a1705988c0ff41e0f4c.exe	cmd.exe
PID 3856 wrote to memory of 2380	3856	390405b92fc7a8de13b82bf8ce7797a0038c58a242081a1705988c0ff41e0f4c.exe	cmd.exe

C:\Users\Admin\AppData\Local\Temp\390405b92fc7a8de13b82bf8ce7797a0038c58a242081a1705988c0ff41e0f4c.exe
"C:\Users\Admin\AppData\Local\Temp\390405b92fc7a8de13b82bf8ce7797a0038c58a242081a1705988c0ff41e0f4c.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:3856

C:\Windows\SysWOW64\cmd.exe
cmd /Q /C C:\Users\Admin\AppData\Local\Temp/s.bat
2⤵
- Drops startup file
PID:2380

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\s.bat
Filesize
323B

MD5
a341238aefbc38fcd8829532a39e21cd

SHA1
789e8d787a6e7949c9e358f7f179b723454fa1c6

SHA256
1ab52e5cf1e3e7594968cf51c78c0c9890a5a48ea5899743529f3be8fbfe3148

SHA512
c98312f09481e559a3c6315aaadce9e0f1a84be73d858c9017ee473f8e98a45422f068c3c92035b97e4870f34bbc46908ae625059d2bc8a73a94246b87182e01

Download Submit
memory/2380-130-0x0000000000000000-mapping.dmp

Download