6bd244fcf3711f5cba246dc3e3a2ca14855c849856a03cb700cb49fe85663de7

Analysis

max time kernel
45s
max time network
49s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
13-02-2023 16:32

Target

lang.bat
Size

1KB
MD5

657b84e6f9b5a375e4766813da6f5db0
SHA1

4c6e5b27342b9eaae0c2f60c46f5b9ed59696f0a
SHA256

e5fe1ce1137dfcdb603d4a31411659cb0846b5327d4a9dd1a6cb7e8219b409ae
SHA512

271aa8146a006dfb1c196ada87e02d54a72b6f4d35971e6b41131cd8ec3ee0e4468cfadd24331c75627985f7fea337c010d36683be52a80394d25e98be88aaa9

Score

3^/10

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Suspicious use of WriteProcessMemory 6 IoCs

description	pid	Process	procid_target
PID 2020 wrote to memory of 936	2020	cmd.exe	29
PID 2020 wrote to memory of 936	2020	cmd.exe	29
PID 2020 wrote to memory of 936	2020	cmd.exe	29
PID 936 wrote to memory of 1916	936	cmd.exe	30
PID 936 wrote to memory of 1916	936	cmd.exe	30
PID 936 wrote to memory of 1916	936	cmd.exe	30

C:\Windows\system32\cmd.exe
cmd /c "C:\Users\Admin\AppData\Local\Temp\lang.bat"
1⤵
- Suspicious use of WriteProcessMemory
PID:2020
- C:\Windows\system32\cmd.exe
  cmd.exe /c start /b /min copy /Y C:\Windows\System32\rundll32.exe C:\ProgramData\p4VvpBZGbyg.exe
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:936
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /K copy /Y C:\Windows\System32\rundll32.exe C:\ProgramData\p4VvpBZGbyg.exe
    3⤵
    PID:1916

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

memory/2020-56-0x000007FEFC2C1000-0x000007FEFC2C3000-memory.dmp

Filesize
8KB

Download