c24c4d805947b473c5f9abf3fa3b2168b1aaf8b282d612d004fd60774da49193

Resubmissions

29/05/2023, 21:43

230529-1kzk2aea7x 6

29/05/2023, 21:40

230529-1h82paea7s 1

Analysis

max time kernel
1800s
max time network
1589s
platform
windows10-2004_x64
resource
win10v2004-20230220-en
resource tags

arch:x64arch:x86image:win10v2004-20230220-enlocale:en-usos:windows10-2004-x64system
submitted
29/05/2023, 21:43

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

del_old_driverpacks.bat
Size

1KB
MD5

059a48f88d38595b3d4fe63d78b509f0
SHA1

5acf13baa930f384227f5d59371491787ebf97c7
SHA256

6d74ad1de33394216a6fd1ffb58e87d90a399bdafa8d2ac223e2377ec5947859
SHA512

397eca1cf2f830316cd39296b5b9015938f777b8e26f00c8ee0ff95639dcbf097e55586c35dbeb5b559d7e17ff90203d396f13a1524bc24b153186005f9f4b5b

Score

5^/10

Malware Config

Signatures

Drops autorun.inf file 1 TTPs 1 IoCs

Malware can abuse Windows Autorun to spread further via attached volumes.

Replication Through Removable Media

T1091

description	ioc	Process
File opened for modification	C:\Users\Admin\AppData\Local\Temp\autorun.inf	attrib.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 5092 wrote to memory of 5060	5092	cmd.exe	82
PID 5092 wrote to memory of 5060	5092	cmd.exe	82
PID 5092 wrote to memory of 4948	5092	cmd.exe	83
PID 5092 wrote to memory of 4948	5092	cmd.exe	83

Views/modifies file attributes 1 TTPs 1 IoCs

evasion

Hidden Files and Directories

T1158

pid	Process
5060	attrib.exe

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\del_old_driverpacks.bat"
1⤵
- Suspicious use of WriteProcessMemory
PID:5092
- C:\Windows\system32\attrib.exe
  attrib *.* -R
  2⤵
  - Drops autorun.inf file
  - Views/modifies file attributes
  PID:5060
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c dir /b *.7z
  2⤵
  PID:4948

Network

MITRE ATT&CK Enterprise v6

Initial Access

Replication Through Removable Media

T1091

Execution

Persistence

Hidden Files and Directories

T1158

Privilege Escalation

Defense Evasion

Hidden Files and Directories

T1158

Credential Access

Discovery

Lateral Movement

Replication Through Removable Media

T1091

Collection

Command and Control

Exfiltration

Impact

Windows 7 deprecation

Loading Replay Monitor...

Resubmissions

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads