0cb8404062b04549b8b8ad5a6b27aeba1a001b0d602c79f196cc16fbd427aa0d | Triage

Analysis

max time kernel
30s
max time network
34s
platform
windows7_x64
resource
win7-20221111-en
resource tags

arch:x64arch:x86image:win7-20221111-enlocale:en-usos:windows7-x64system
submitted
08-01-2023 05:11

Sharing

Report Analysis Logs

General

Target

Install.bat
Size

308B
MD5

05ea96804213722f35f7ca76e1e3e350
SHA1

a873c5dc79a671ea5c33bc1a21f853b60a794f3e
SHA256

fa439350a1259088825dd533111de0b43b8d851f68daa3eeb49b0d498834010e
SHA512

08ee3f84b198fe1fbccca17260d6185ba37e87ffc5acf8eda1ecf9e4b670900b51d9917a2ef8ddd30308ea603ddac35789abb4ded8e05ada6a996fb5c14bcec7

Score

1^/10

Malware Config

Signatures

Suspicious use of WriteProcessMemory 6 IoCs

description	pid	Process	procid_target
PID 1772 wrote to memory of 1792	1772	cmd.exe	29
PID 1772 wrote to memory of 1792	1772	cmd.exe	29
PID 1772 wrote to memory of 1792	1772	cmd.exe	29
PID 1772 wrote to memory of 936	1772	cmd.exe	30
PID 1772 wrote to memory of 936	1772	cmd.exe	30
PID 1772 wrote to memory of 936	1772	cmd.exe	30

C:\Windows\system32\cmd.exe
cmd /c "C:\Users\Admin\AppData\Local\Temp\Install.bat"
1⤵
- Suspicious use of WriteProcessMemory
PID:1772
- C:\Windows\System32\PnPutil.exe
  .\pnputil /add-driver "C:\Users\Admin\AppData\Local\Temp\ibtusb.inf" /install
  2⤵
  PID:1792
- C:\Windows\system32\PnPutil.exe
  C:\Windows/system32/pnputil /add-driver ibtusb.inf /install
  2⤵
  PID:936

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads