8664cc0492e319baa8ef51a3233a7173cb25a7deb00af4dfd2e4b4b38a48990b | Triage

Resubmissions

26/10/2022, 21:55

221026-1stprahccq 10

26/10/2022, 21:52

221026-1rkepahcb5 10

Analysis

max time kernel
90s
max time network
110s
platform
windows10-2004_x64
resource
win10v2004-20220901-en
resource tags

arch:x64arch:x86image:win10v2004-20220901-enlocale:en-usos:windows10-2004-x64system
submitted
26/10/2022, 21:55

Sharing

Report Analysis Logs

General

Target

inexhaustive/caged.cmd
Size

302B
MD5

36b77bdd5eabd34d95d105d692e5779d
SHA1

f3a96469ba6d3919e8f2669a865c29653c3e183c
SHA256

d9d5509cde3c962af4cdf5d6827779ef8d33902d83468d6bedb75c6121a8270a
SHA512

90a7265aee7febf08f641da8e27b6e6acf51eebc509ab8b7cfa7b29ee961a0afa0dc4980f2f853175fa741e4d3c2cee5c03a962ac6a643f2e60e897b1d065579

Score

1^/10

Malware Config

Signatures

Suspicious use of WriteProcessMemory 2 IoCs

description	pid	Process	procid_target
PID 360 wrote to memory of 4312	360	cmd.exe	82
PID 360 wrote to memory of 4312	360	cmd.exe	82

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\inexhaustive\caged.cmd"
1⤵
- Suspicious use of WriteProcessMemory
PID:360
- C:\Windows\system32\replace.exe
  replace C:\Windows\\system32\\r32.exe C:\Users\Admin\AppData\Local\Temp /A
  2⤵
  PID:4312

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads