99482cc76a3f020bbca4609e4b4d39e3577543443898941b916079dc9b738fb3 | Triage

Analysis

max time kernel
43s
max time network
45s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
02-11-2022 18:59

Sharing

Report Analysis Logs

General

Target

notrobassfir/colonelclothes.bat
Size

1KB
MD5

ccd8689373558c3bc18aa89994fde940
SHA1

3b82acecef9a9b5c8c3b2343e1082a7a95baedcb
SHA256

9bf48a2dfaa3acdbf45552a1bc73c7679ec754cd0d67b6936cfb88aa6130cb6b
SHA512

a721d9ec1015c3d0558fd7eac4eb23a34877ac5aa0c2d629069a26afcd5eb7a50062a48ccb14dec0790735a4d20f91fe17dce46c02bacd0f30533f9d017e9ae1

Score

1^/10

Malware Config

Signatures

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 1824 wrote to memory of 1872	1824	cmd.exe	28
PID 1824 wrote to memory of 1872	1824	cmd.exe	28
PID 1824 wrote to memory of 1872	1824	cmd.exe	28

C:\Windows\system32\cmd.exe
cmd /c "C:\Users\Admin\AppData\Local\Temp\notrobassfir\colonelclothes.bat"
1⤵
- Suspicious use of WriteProcessMemory
PID:1824
- C:\Windows\system32\xcopy.exe
  xcopy /s /i /e /h notrobassfir\imposing.dat C:\Users\Admin\AppData\Local\Temp\*
  2⤵
  PID:1872

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads