124147553a430f22bb4774d2037fe27cd565b23043834ba283d5206c56a45a40

Analysis

max time kernel
5s
max time network
31s
platform
windows7_x64
resource
win7-20230220-en
resource tags

arch:x64arch:x86image:win7-20230220-enlocale:en-usos:windows7-x64system
submitted
11/05/2023, 15:57

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

fzed.bat
Size

1KB
MD5

992baa48ee0f730e5cdf6e54585eae5c
SHA1

f440dc5f7e9256374de948a47dba122fda5c98f3
SHA256

124147553a430f22bb4774d2037fe27cd565b23043834ba283d5206c56a45a40
SHA512

6add67a9f9e06ea2e3a1137686ae53dec70769b9687b9a59aeaf015f0734a6dc2d254d87c6ace324157f0cd764aaf5431ae07b6802dd06f53d7642a11f221d41

Score

1^/10

Malware Config

Signatures

Runs net.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 924 wrote to memory of 1916	924	cmd.exe	28
PID 924 wrote to memory of 1916	924	cmd.exe	28
PID 924 wrote to memory of 1916	924	cmd.exe	28
PID 1916 wrote to memory of 876	1916	net.exe	29
PID 1916 wrote to memory of 876	1916	net.exe	29
PID 1916 wrote to memory of 876	1916	net.exe	29
PID 924 wrote to memory of 864	924	cmd.exe	30
PID 924 wrote to memory of 864	924	cmd.exe	30
PID 924 wrote to memory of 864	924	cmd.exe	30
PID 864 wrote to memory of 764	864	net.exe	31
PID 864 wrote to memory of 764	864	net.exe	31
PID 864 wrote to memory of 764	864	net.exe	31
PID 924 wrote to memory of 1164	924	cmd.exe	32
PID 924 wrote to memory of 1164	924	cmd.exe	32
PID 924 wrote to memory of 1164	924	cmd.exe	32
PID 1164 wrote to memory of 1856	1164	net.exe	33
PID 1164 wrote to memory of 1856	1164	net.exe	33
PID 1164 wrote to memory of 1856	1164	net.exe	33
PID 924 wrote to memory of 660	924	cmd.exe	34
PID 924 wrote to memory of 660	924	cmd.exe	34
PID 924 wrote to memory of 660	924	cmd.exe	34
PID 660 wrote to memory of 860	660	net.exe	35
PID 660 wrote to memory of 860	660	net.exe	35
PID 660 wrote to memory of 860	660	net.exe	35
PID 924 wrote to memory of 2004	924	cmd.exe	36
PID 924 wrote to memory of 2004	924	cmd.exe	36
PID 924 wrote to memory of 2004	924	cmd.exe	36
PID 2004 wrote to memory of 1668	2004	net.exe	37
PID 2004 wrote to memory of 1668	2004	net.exe	37
PID 2004 wrote to memory of 1668	2004	net.exe	37
PID 924 wrote to memory of 980	924	cmd.exe	38
PID 924 wrote to memory of 980	924	cmd.exe	38
PID 924 wrote to memory of 980	924	cmd.exe	38
PID 980 wrote to memory of 2020	980	net.exe	39
PID 980 wrote to memory of 2020	980	net.exe	39
PID 980 wrote to memory of 2020	980	net.exe	39
PID 924 wrote to memory of 1484	924	cmd.exe	40
PID 924 wrote to memory of 1484	924	cmd.exe	40
PID 924 wrote to memory of 1484	924	cmd.exe	40
PID 1484 wrote to memory of 1408	1484	net.exe	41
PID 1484 wrote to memory of 1408	1484	net.exe	41
PID 1484 wrote to memory of 1408	1484	net.exe	41
PID 924 wrote to memory of 1248	924	cmd.exe	42
PID 924 wrote to memory of 1248	924	cmd.exe	42
PID 924 wrote to memory of 1248	924	cmd.exe	42
PID 1248 wrote to memory of 300	1248	net.exe	43
PID 1248 wrote to memory of 300	1248	net.exe	43
PID 1248 wrote to memory of 300	1248	net.exe	43
PID 924 wrote to memory of 1364	924	cmd.exe	44
PID 924 wrote to memory of 1364	924	cmd.exe	44
PID 924 wrote to memory of 1364	924	cmd.exe	44
PID 1364 wrote to memory of 316	1364	net.exe	45
PID 1364 wrote to memory of 316	1364	net.exe	45
PID 1364 wrote to memory of 316	1364	net.exe	45
PID 924 wrote to memory of 940	924	cmd.exe	46
PID 924 wrote to memory of 940	924	cmd.exe	46
PID 924 wrote to memory of 940	924	cmd.exe	46
PID 940 wrote to memory of 1568	940	net.exe	47
PID 940 wrote to memory of 1568	940	net.exe	47
PID 940 wrote to memory of 1568	940	net.exe	47
PID 924 wrote to memory of 1372	924	cmd.exe	48
PID 924 wrote to memory of 1372	924	cmd.exe	48
PID 924 wrote to memory of 1372	924	cmd.exe	48
PID 1372 wrote to memory of 1556	1372	net.exe	49

C:\Windows\system32\cmd.exe
cmd /c "C:\Users\Admin\AppData\Local\Temp\fzed.bat"
1⤵
- Suspicious use of WriteProcessMemory
PID:924
- C:\Windows\system32\net.exe
  net share c$ /delete /y
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1916
- - C:\Windows\system32\net1.exe
    C:\Windows\system32\net1 share c$ /delete /y
    3⤵
    PID:876
- C:\Windows\system32\net.exe
  net share ipc$ /delete /y
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:864
- - C:\Windows\system32\net1.exe
    C:\Windows\system32\net1 share ipc$ /delete /y
    3⤵
    PID:764
- C:\Windows\system32\net.exe
  net share admin$ /delete /y
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1164
- - C:\Windows\system32\net1.exe
    C:\Windows\system32\net1 share admin$ /delete /y
    3⤵
    PID:1856
- C:\Windows\system32\net.exe
  net share d$ /delete /y
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:660
- - C:\Windows\system32\net1.exe
    C:\Windows\system32\net1 share d$ /delete /y
    3⤵
    PID:860
- C:\Windows\system32\net.exe
  net share e$ /delete /y
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2004
- - C:\Windows\system32\net1.exe
    C:\Windows\system32\net1 share e$ /delete /y
    3⤵
    PID:1668
  - - C:\Windows\system32\net1.exe
      C:\Windows\system32\net1 share Shared Docs /delete /y
      4⤵
      PID:2004
- C:\Windows\system32\net.exe
  net share f$ /delete /y
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:980
- - C:\Windows\system32\net1.exe
    C:\Windows\system32\net1 share f$ /delete /y
    3⤵
    PID:2020
- C:\Windows\system32\net.exe
  net share g$ /delete /y
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1484
- - C:\Windows\system32\net1.exe
    C:\Windows\system32\net1 share g$ /delete /y
    3⤵
    PID:1408
- C:\Windows\system32\net.exe
  net share h$ /delete /y
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1248
- - C:\Windows\system32\net1.exe
    C:\Windows\system32\net1 share h$ /delete /y
    3⤵
    PID:300
- C:\Windows\system32\net.exe
  net share i$ /delete /y
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1364
- - C:\Windows\system32\net1.exe
    C:\Windows\system32\net1 share i$ /delete /y
    3⤵
    PID:316
- C:\Windows\system32\net.exe
  net share j$ /delete /y
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:940
- - C:\Windows\system32\net1.exe
    C:\Windows\system32\net1 share j$ /delete /y
    3⤵
    PID:1568
- C:\Windows\system32\net.exe
  net share k$ /delete /y
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1372
- - C:\Windows\system32\net1.exe
    C:\Windows\system32\net1 share k$ /delete /y
    3⤵
    PID:1556
- C:\Windows\system32\net.exe
  net share l$ /delete /y
  2⤵
  PID:1932
- - C:\Windows\system32\net1.exe
    C:\Windows\system32\net1 share l$ /delete /y
    3⤵
    PID:596
- C:\Windows\system32\net.exe
  net share m$ /delete /y
  2⤵
  PID:524
- - C:\Windows\system32\net1.exe
    C:\Windows\system32\net1 share m$ /delete /y
    3⤵
    PID:1748
- C:\Windows\system32\net.exe
  net share n$ /delete /y
  2⤵
  PID:1988
- - C:\Windows\system32\net1.exe
    C:\Windows\system32\net1 share n$ /delete /y
    3⤵
    PID:432
- C:\Windows\system32\net.exe
  net share o$ /delete /y
  2⤵
  PID:880
- - C:\Windows\system32\net1.exe
    C:\Windows\system32\net1 share o$ /delete /y
    3⤵
    PID:616
- C:\Windows\system32\net.exe
  net share p$ /delete /y
  2⤵
  PID:1512
- - C:\Windows\system32\net1.exe
    C:\Windows\system32\net1 share p$ /delete /y
    3⤵
    PID:1184
- C:\Windows\system32\net.exe
  net share r$ /delete /y
  2⤵
  PID:1228
- - C:\Windows\system32\net1.exe
    C:\Windows\system32\net1 share r$ /delete /y
    3⤵
    PID:820
- C:\Windows\system32\net.exe
  net share s$ /delete /y
  2⤵
  PID:480
- - C:\Windows\system32\net1.exe
    C:\Windows\system32\net1 share s$ /delete /y
    3⤵
    PID:284
- C:\Windows\system32\net.exe
  net share t$ /delete /y
  2⤵
  PID:1956
- - C:\Windows\system32\net1.exe
    C:\Windows\system32\net1 share t$ /delete /y
    3⤵
    PID:1088
- C:\Windows\system32\net.exe
  net share u$ /delete /y
  2⤵
  PID:1400
- - C:\Windows\system32\net1.exe
    C:\Windows\system32\net1 share u$ /delete /y
    3⤵
    PID:1692
- C:\Windows\system32\net.exe
  net share v$ /delete /y
  2⤵
  PID:836
- - C:\Windows\system32\net1.exe
    C:\Windows\system32\net1 share v$ /delete /y
    3⤵
    PID:1136
- C:\Windows\system32\net.exe
  net share w$ /delete /y
  2⤵
  PID:1572
- - C:\Windows\system32\net1.exe
    C:\Windows\system32\net1 share w$ /delete /y
    3⤵
    PID:1552
- C:\Windows\system32\net.exe
  net share x$ /delete /y
  2⤵
  PID:1580
- - C:\Windows\system32\net1.exe
    C:\Windows\system32\net1 share x$ /delete /y
    3⤵
    PID:1936
- C:\Windows\system32\net.exe
  net share y$ /delete /y
  2⤵
  PID:876
- - C:\Windows\system32\net1.exe
    C:\Windows\system32\net1 share y$ /delete /y
    3⤵
    PID:1916
- C:\Windows\system32\net.exe
  net share z$ /delete /y
  2⤵
  PID:764
- - C:\Windows\system32\net1.exe
    C:\Windows\system32\net1 share z$ /delete /y
    3⤵
    PID:864
- C:\Windows\system32\net.exe
  net share print$ /delete /y
  2⤵
  PID:1856
- - C:\Windows\system32\net1.exe
    C:\Windows\system32\net1 share print$ /delete /y
    3⤵
    PID:1164
- C:\Windows\system32\net.exe
  net share My Documents /delete /y
  2⤵
  PID:860
- - C:\Windows\system32\net1.exe
    C:\Windows\system32\net1 share My Documents /delete /y
    3⤵
    PID:660
- C:\Windows\system32\net.exe
  net share Shared Docs /delete /y
  2⤵
  PID:1668

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads