0d20d075cf8e97e778f907255f5d6fe18de6f7d0da42c7bc2af700a2f69b72b1

Analysis

max time kernel
27s
max time network
33s
platform
windows7_x64
resource
win7-20221111-en
resource tags

arch:x64arch:x86image:win7-20221111-enlocale:en-usos:windows7-x64system
submitted
01-01-2023 17:32

Target

data/plugins/aal_off.bat
Size

282B
MD5

7909d0f3e06e9f25fb3bd89b450d457e
SHA1

b276ee7c5502fd2fadcce06a965f071cba9cdc54
SHA256

c7a6d1cb6016cbc9f940e1e08bb83bc4737253d190626d431b3f9171cd3b2ee0
SHA512

e920a1be3b055e05511f95ad816cbec7bbdc7d6ca06d5535014797d4a3a56fdece66f56098dd893eae1164d4500bb67d2dcafcbacc8bc61a72c7607c4936b0a9

Score

1^/10

Suspicious use of WriteProcessMemory 9 IoCs

description	pid	Process	procid_target
PID 2000 wrote to memory of 1956	2000	cmd.exe	29
PID 2000 wrote to memory of 1956	2000	cmd.exe	29
PID 2000 wrote to memory of 1956	2000	cmd.exe	29
PID 2000 wrote to memory of 1484	2000	cmd.exe	30
PID 2000 wrote to memory of 1484	2000	cmd.exe	30
PID 2000 wrote to memory of 1484	2000	cmd.exe	30
PID 2000 wrote to memory of 1348	2000	cmd.exe	31
PID 2000 wrote to memory of 1348	2000	cmd.exe	31
PID 2000 wrote to memory of 1348	2000	cmd.exe	31

C:\Windows\system32\cmd.exe
cmd /c "C:\Users\Admin\AppData\Local\Temp\data\plugins\aal_off.bat"
1⤵
- Suspicious use of WriteProcessMemory
PID:2000
- C:\Windows\system32\reg.exe
  REG DELETE "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon" /V AutoAdminLogon /F
  2⤵
  PID:1956
- C:\Windows\system32\reg.exe
  REG DELETE "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon" /V DefaultUserName /F
  2⤵
  PID:1484
- C:\Windows\system32\reg.exe
  REG DELETE "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon" /V DefaultPassword /F
  2⤵
  PID:1348