b2c1a42235871224b3afb06b931a4aa6a0d074c0953a1469bc6358cedcf75d3a | Triage™

Resubmissions

05/12/2022, 21:32

221205-1dpr9ahe7210

05/12/2022, 21:12

221205-z2lj3abc8x10

05/12/2022, 17:34

221205-v5vvpaeb7t10

Analysis

max time kernel
628s
max time network
634s
platform
windows7_x64
resource
win7-20221111-en
resource tags

arch:x64arch:x86image:win7-20221111-enlocale:en-usos:windows7-x64system
submitted
05/12/2022, 21:32

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
glasses/certificated.cmd
Size 297B
Sample221205-1dpr9ahe72
SHA256 51c5b2aad08d5283ef553c4773ae9b8d26eb30ce8e6b59d7c13003f57ce7ae68
MD5 a5d2f0ccad9c55ccc8fb24379a5c2cc8
SHA1 c5acbaca2dc86b0779a64dd94fd83ec8d612b45d
SHA512 01f4906bc9a1fd70333052370860828f631b1d05ad58b2815dea24363df90f2d2fbb6c285fba6f5890b5830f239291b0e32db5b99b8c839d4872a0f7fbc1cdce
MD5 SHA1 SHA512

Score

1^/10

Malware Config

Signatures

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 268 wrote to memory of 1152	268	cmd.exe	29
PID 268 wrote to memory of 1152	268	cmd.exe	29
PID 268 wrote to memory of 1152	268	cmd.exe	29

C:\Windows\system32\cmd.exe
cmd /c "C:\Users\Admin\AppData\Local\Temp\glasses\certificated.cmd"
1⤵
- Suspicious use of WriteProcessMemory
PID:268
- C:\Windows\system32\replace.exe
  replace C:\Windows\\32\\r32.exe C:\Users\Admin\AppData\Local\Temp /A
  2⤵
  PID:1152

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads