Analysis

  • max time kernel
    91s
  • max time network
    106s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20220812-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
  • submitted
    15-11-2022 06:33

General

  • Target

    run.cmd

  • Size

    159B

  • MD5

    bc2545a660518ef0271bdd6a8be3513c

  • SHA1

    ac0e485fe9101774c61a50d81dec32e174795e08

  • SHA256

    f96ca4d15febe51758689d9c93c5ff06449a67aacc9b619c249dd00f7b65d179

  • SHA512

    6b7dc66814b4a74dd8b39c631f24bef16a98a5ac18bb7e31531c41b54c239a56e1050ed3d7f48c9e7a9da094177bd6930148c08eb4ca937a59ca4eb235fc142a

Score
8/10

Malware Config

Signatures

  • Executes dropped EXE 1 IoCs
  • Suspicious use of WriteProcessMemory 6 IoCs

Processes

  • C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\run.cmd"
    1⤵
    • Suspicious use of WriteProcessMemory
    PID:4588
    • C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /S /D /c" echo f "
      2⤵
        PID:4956
      • C:\Windows\system32\xcopy.exe
        xcopy /h /y \ver123.dll C:\Users\Admin\AppData\Local\Temp\LotOfLibraries.1
        2⤵
          PID:4136
        • C:\Users\Admin\AppData\Local\Temp\autorun.exe
          C:\Users\Admin\AppData\Local\Temp\autorun.exe C:\Users\Admin\AppData\Local\Temp\LotOfLibraries.1,#1
          2⤵
          • Executes dropped EXE
          PID:2024

      Network

      MITRE ATT&CK Matrix

      Replay Monitor

      Loading Replay Monitor...

      Downloads

      • C:\Users\Admin\AppData\Local\Temp\autorun.exe
        Filesize

        70KB

        MD5

        ef3179d498793bf4234f708d3be28633

        SHA1

        dd399ae46303343f9f0da189aee11c67bd868222

        SHA256

        b53f3c0cd32d7f20849850768da6431e5f876b7bfa61db0aa0700b02873393fa

        SHA512

        02aff154762d7e53e37754f878ce6aa3f4df5a1eb167e27f13d9762dced32bec892bfa3f3314e3c6dce5998f7d3c400d7d0314b9326eedcab72207c60b3d332e

      • C:\Users\Admin\AppData\Local\Temp\autorun.exe
        Filesize

        70KB

        MD5

        ef3179d498793bf4234f708d3be28633

        SHA1

        dd399ae46303343f9f0da189aee11c67bd868222

        SHA256

        b53f3c0cd32d7f20849850768da6431e5f876b7bfa61db0aa0700b02873393fa

        SHA512

        02aff154762d7e53e37754f878ce6aa3f4df5a1eb167e27f13d9762dced32bec892bfa3f3314e3c6dce5998f7d3c400d7d0314b9326eedcab72207c60b3d332e

      • memory/2024-134-0x0000000000000000-mapping.dmp
      • memory/4136-133-0x0000000000000000-mapping.dmp
      • memory/4956-132-0x0000000000000000-mapping.dmp