6e4bbe324dad0e0790d4726fbd4fa5630b6150dddef8f78d5e5e724e9cf0a7f8 | Triage

Analysis

max time kernel
76s
max time network
79s
platform
windows10-2004_x64
resource
win10v2004-20230220-en
resource tags

arch:x64arch:x86image:win10v2004-20230220-enlocale:en-usos:windows10-2004-x64system
submitted
26/05/2023, 14:19

Sharing

Report Analysis Logs

General

Target

test.bat
Size

109B
MD5

69bf762b43d639b93fe3c0c348dae17a
SHA1

9a4f658542f180511ac53f7d4cf6dea334eff6a5
SHA256

6e4bbe324dad0e0790d4726fbd4fa5630b6150dddef8f78d5e5e724e9cf0a7f8
SHA512

7149c5a2038ee56fa6f553942d298856b86e3d6fff34a7272e8862eb195fb94e250d182a4b3196764c4f5b71d64cf870f9a4cc2cfc6d6ffdcc1ce5a5a0135953

Score

1^/10

Malware Config

Signatures

Opens file in notepad (likely ransom note) 1 IoCs

pid	Process
380	NOTEPAD.EXE

Suspicious use of WriteProcessMemory 10 IoCs

description	pid	Process	procid_target
PID 1224 wrote to memory of 4556	1224	cmd.exe	84
PID 1224 wrote to memory of 4556	1224	cmd.exe	84
PID 1224 wrote to memory of 4760	1224	cmd.exe	86
PID 1224 wrote to memory of 4760	1224	cmd.exe	86
PID 4556 wrote to memory of 736	4556	cmd.exe	94
PID 4556 wrote to memory of 736	4556	cmd.exe	94
PID 3672 wrote to memory of 3196	3672	cmd.exe	108
PID 3672 wrote to memory of 3196	3672	cmd.exe	108
PID 3672 wrote to memory of 1304	3672	cmd.exe	110
PID 3672 wrote to memory of 1304	3672	cmd.exe	110

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\test.bat"
1⤵
- Suspicious use of WriteProcessMemory
PID:1224
- C:\Windows\system32\cmd.exe
  cmd /k ":loop && start cmd /k ":loop
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:4556
- - C:\Windows\system32\tree.com
    tree
    3⤵
    PID:736
- C:\Windows\system32\tree.com
  tree
  2⤵
  PID:4760

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe shell32.dll,SHCreateLocalServerRunDll {24AC8F2B-4D4A-4C17-9607-6A4B14068F97} -Embedding
1⤵
PID:2284

C:\Windows\System32\DataExchangeHost.exe
C:\Windows\System32\DataExchangeHost.exe -Embedding
1⤵
PID:872

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:1544

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\Desktop\test.bat" "
1⤵
- Suspicious use of WriteProcessMemory
PID:3672
- C:\Windows\system32\cmd.exe
  cmd /k ":loop && start cmd /k ":loop
  2⤵
  PID:3196
- C:\Windows\system32\tree.com
  tree
  2⤵
  PID:1304

C:\Windows\System32\NOTEPAD.EXE
"C:\Windows\System32\NOTEPAD.EXE" C:\Users\Admin\Desktop\test.bat
1⤵
- Opens file in notepad (likely ransom note)
PID:380

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads