83a8964159c897e4cdf69424700423bae5b024485c96448560e03e99fc486b68 | Triage

Analysis

max time kernel
94s
max time network
143s
platform
windows10-2004_x64
resource
win10v2004-20230220-en
resource tags

arch:x64arch:x86image:win10v2004-20230220-enlocale:en-usos:windows10-2004-x64system
submitted
09/05/2023, 06:51

Sharing

Report Analysis Logs

General

Target

return_4.3.bat
Size

39KB
MD5

9c6732699368cfaff6976170f8548dee
SHA1

4decd201cf6fb2a2adfacf5b85b36ba1be14295c
SHA256

83a8964159c897e4cdf69424700423bae5b024485c96448560e03e99fc486b68
SHA512

cdd992ccd5669abd297fee5a52fd07992e562ddcd6e2595bfd91c2a2edb527d04009e0e751bcc5c40d933ad5a63712ca693889de2f900df7e3e4c56a21c32f99
SSDEEP

192:KB3VLbzreU4UuINnSx1483t+u2Dl+XOxKeJlYvaFnyiR6gSmyT7fflEz3:KBFLf4INSx1483t5Gx9lDegSmn

Score

1^/10

Malware Config

Signatures

Suspicious use of WriteProcessMemory 6 IoCs

description	pid	Process	procid_target
PID 1668 wrote to memory of 3932	1668	cmd.exe	84
PID 1668 wrote to memory of 3932	1668	cmd.exe	84
PID 1668 wrote to memory of 1700	1668	cmd.exe	85
PID 1668 wrote to memory of 1700	1668	cmd.exe	85
PID 1668 wrote to memory of 3344	1668	cmd.exe	86
PID 1668 wrote to memory of 3344	1668	cmd.exe	86

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\return_4.3.bat"
1⤵
- Suspicious use of WriteProcessMemory
PID:1668
- C:\Windows\system32\mode.com
  Mode 75,6
  2⤵
  PID:3932
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c "prompt #$H#$E# & echo on & for %b in (1) do rem"
  2⤵
  PID:1700
- C:\Windows\system32\chcp.com
  chcp 65001
  2⤵
  PID:3344

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads