0d20d075cf8e97e778f907255f5d6fe18de6f7d0da42c7bc2af700a2f69b72b1

Analysis

max time kernel
26s
max time network
33s
platform
windows7_x64
resource
win7-20221111-en
resource tags

arch:x64arch:x86image:win7-20221111-enlocale:en-usos:windows7-x64system
submitted
01-01-2023 17:32

Target

data/plugins/aal_on.bat
Size

493B
MD5

f279c0a6c0c871495f5455c341a77eca
SHA1

d720fef70745e47c15e452b9074d1f822cec9b8b
SHA256

2b02983a37672881d7f943ae0177dcaab3f44681481d00cc48940f8944c83824
SHA512

046a941e82b2eaab803d78032c3530366a2ada853b15513bd3244038382a9430df453b310649c17e187569a94e5ff44fc7bc9e94ab48aa722a9a142f101d12dc

Score

1^/10

Suspicious use of WriteProcessMemory 12 IoCs

description	pid	Process	procid_target
PID 1652 wrote to memory of 1128	1652	cmd.exe	29
PID 1652 wrote to memory of 1128	1652	cmd.exe	29
PID 1652 wrote to memory of 1128	1652	cmd.exe	29
PID 1652 wrote to memory of 1776	1652	cmd.exe	30
PID 1652 wrote to memory of 1776	1652	cmd.exe	30
PID 1652 wrote to memory of 1776	1652	cmd.exe	30
PID 1652 wrote to memory of 1240	1652	cmd.exe	31
PID 1652 wrote to memory of 1240	1652	cmd.exe	31
PID 1652 wrote to memory of 1240	1652	cmd.exe	31
PID 1652 wrote to memory of 2044	1652	cmd.exe	32
PID 1652 wrote to memory of 2044	1652	cmd.exe	32
PID 1652 wrote to memory of 2044	1652	cmd.exe	32

C:\Windows\system32\cmd.exe
cmd /c "C:\Users\Admin\AppData\Local\Temp\data\plugins\aal_on.bat"
1⤵
- Suspicious use of WriteProcessMemory
PID:1652
- C:\Windows\system32\reg.exe
  REG ADD "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon" /V AutoAdminLogon /T REG_SZ /D 1 /F
  2⤵
  PID:1128
- C:\Windows\system32\reg.exe
  REG ADD "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon" /V DefaultUserName /T REG_SZ /D Admin /F
  2⤵
  PID:1776
- C:\Windows\system32\reg.exe
  REG ADD "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon" /V DefaultPassword /T REG_SZ /D __PASSWORD__ /F
  2⤵
  PID:1240
- C:\Windows\system32\msg.exe
  msg "Admin" "Please add a Password for the currently logged user here: HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon |DefaultPassword:"
  2⤵
  PID:2044