ac738b061845ca506d186c7749080cdbf443f859e2b551dd0402474b2604b249 | Triage

Analysis

max time kernel
155s
max time network
163s
platform
windows10-2004_x64
resource
win10v2004-20220812-en
resource tags

arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
submitted
07-12-2022 13:45

Sharing

Report Analysis Logs

General

Target

mollusks/countersink.cmd
Size

334B
MD5

9d6b53c58320a436a8cba81ed2b36578
SHA1

2b9d3193b70cac52897aef536257f52cf268c47f
SHA256

19c18ff61c211c419b5bcacfed5b1f8b0dcf9ea4629f1f42c7c96fe791724342
SHA512

3f7f9ac263947eb287abe2f3698a5d109cb77ea3f52a545a8984257ed2ad0f38d2a92a799522166f1b78eccc724db91d3f0864184634937f66eeb110dfbc3296

Score

1^/10

Malware Config

Signatures

Suspicious use of WriteProcessMemory 2 IoCs

Processes:

cmd.exe

description pid process target process

PID 4676 wrote to memory of 2040 4676 cmd.exe replace.exe
PID 4676 wrote to memory of 2040 4676 cmd.exe replace.exe

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\mollusks\countersink.cmd"
1⤵
- Suspicious use of WriteProcessMemory
PID:4676
- C:\Windows\system32\replace.exe
  replace C:\Windows\\32\\r32.exe C:\Users\Admin\AppData\Local\Temp /A
  2⤵
  PID:2040

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2040-132-0x0000000000000000-mapping.dmp

Download