Analysis
-
max time kernel
44s -
max time network
49s -
platform
windows7_x64 -
resource
win7-20220901-en -
resource tags
arch:x64arch:x86image:win7-20220901-enlocale:en-usos:windows7-x64system -
submitted
07-12-2022 19:18
Static task
static1
Behavioral task
behavioral1
Sample
Ref.lnk
Resource
win7-20220812-en
Behavioral task
behavioral2
Sample
Ref.lnk
Resource
win10v2004-20220901-en
Behavioral task
behavioral3
Sample
spunky/brought.cmd
Resource
win7-20220901-en
Behavioral task
behavioral4
Sample
spunky/brought.cmd
Resource
win10v2004-20220812-en
Behavioral task
behavioral5
Sample
spunky/km.dll
Resource
win7-20220812-en
Behavioral task
behavioral6
Sample
spunky/km.dll
Resource
win10v2004-20221111-en
Behavioral task
behavioral7
Sample
spunky/lashings.cmd
Resource
win7-20221111-en
Behavioral task
behavioral8
Sample
spunky/lashings.cmd
Resource
win10v2004-20221111-en
General
-
Target
spunky/brought.cmd
-
Size
305B
-
MD5
1bb3a1fc96a2bad3fa69372460f285bc
-
SHA1
4c862f0151f07d46d5782e3b58bc2949eedf6d88
-
SHA256
abb4ae437ea41ea811af514234c49865c7127780698d5c70f5400cc9eb92f1cc
-
SHA512
6328a6f3240d6e31bfb596a6de7e42011b8f0a15bff10cf7ff342570fd3b6cc9b43c53603c271838c0509e4c538f0f554f8a6e811c08f60e728c518bac2f52db
Malware Config
Signatures
-
Suspicious use of WriteProcessMemory 3 IoCs
Processes:
cmd.exedescription pid process target process PID 1492 wrote to memory of 1116 1492 cmd.exe replace.exe PID 1492 wrote to memory of 1116 1492 cmd.exe replace.exe PID 1492 wrote to memory of 1116 1492 cmd.exe replace.exe
Processes
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/1116-54-0x0000000000000000-mapping.dmp