e95c2508bab20b1fb478a24d4c4a3ee75bec5e1b8e7a0c66928948cec30773cf | Triage

Analysis

max time kernel
90s
max time network
154s
platform
windows10-2004_x64
resource
win10v2004-20220812-en
resource tags

arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
submitted
26-01-2023 02:53

Sharing

Report Analysis Logs

General

Target

happytime-onvif-server/runme.bat
Size

80B
MD5

9bc36fe28b93d9cfaba18a9d62e0290c
SHA1

7473639209534d61608054669fd89339a99547f3
SHA256

5343847534e1fba2cb34e2a65520f5d8717c789363f08d12c82ac8e3a145b90f
SHA512

5824c7fde4063c9502a612102fa2daf4556738b65ffd144482b25bda9e844efcdd996b6e43c1161f5d8b992da3c08a847a8f98d74685bc04feddb1aaa3df5603

Score

1^/10

Malware Config

Signatures

Suspicious use of WriteProcessMemory 6 IoCs

Processes:

cmd.exe

description	pid	process	target process
PID 4440 wrote to memory of 3716	4440	cmd.exe	RtspServer.exe
PID 4440 wrote to memory of 3716	4440	cmd.exe	RtspServer.exe
PID 4440 wrote to memory of 3716	4440	cmd.exe	RtspServer.exe
PID 4440 wrote to memory of 3100	4440	cmd.exe	OnvifServer.exe
PID 4440 wrote to memory of 3100	4440	cmd.exe	OnvifServer.exe
PID 4440 wrote to memory of 3100	4440	cmd.exe	OnvifServer.exe

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\happytime-onvif-server\runme.bat"
1⤵
- Suspicious use of WriteProcessMemory
PID:4440

C:\Users\Admin\AppData\Local\Temp\happytime-onvif-server\happytime-rtsp-server\RtspServer.exe
rtspserver.exe
2⤵
PID:3716

C:\Users\Admin\AppData\Local\Temp\happytime-onvif-server\OnvifServer.exe
OnvifServer.exe
2⤵
PID:3100

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/3100-133-0x0000000000000000-mapping.dmp

Download
memory/3716-132-0x0000000000000000-mapping.dmp

Download