6bd244fcf3711f5cba246dc3e3a2ca14855c849856a03cb700cb49fe85663de7 | Triage

Analysis

max time kernel
149s
max time network
152s
platform
windows10-2004_x64
resource
win10v2004-20220812-en
resource tags

arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
submitted
13-02-2023 16:32

Sharing

Report Analysis Logs

General

Target

lang.bat
Size

1KB
MD5

657b84e6f9b5a375e4766813da6f5db0
SHA1

4c6e5b27342b9eaae0c2f60c46f5b9ed59696f0a
SHA256

e5fe1ce1137dfcdb603d4a31411659cb0846b5327d4a9dd1a6cb7e8219b409ae
SHA512

271aa8146a006dfb1c196ada87e02d54a72b6f4d35971e6b41131cd8ec3ee0e4468cfadd24331c75627985f7fea337c010d36683be52a80394d25e98be88aaa9

Score

3^/10

Malware Config

Signatures

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1368 wrote to memory of 928	1368	cmd.exe	83
PID 1368 wrote to memory of 928	1368	cmd.exe	83
PID 928 wrote to memory of 1992	928	cmd.exe	82
PID 928 wrote to memory of 1992	928	cmd.exe	82

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\lang.bat"
1⤵
- Suspicious use of WriteProcessMemory
PID:1368
- C:\Windows\system32\cmd.exe
  cmd.exe /c start /b /min copy /Y C:\Windows\System32\rundll32.exe C:\ProgramData\p4VvpBZGbyg.exe
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:928

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /K copy /Y C:\Windows\System32\rundll32.exe C:\ProgramData\p4VvpBZGbyg.exe
1⤵
PID:1992

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads