c24c4d805947b473c5f9abf3fa3b2168b1aaf8b282d612d004fd60774da49193 | Triage

Resubmissions

29/05/2023, 21:43

230529-1kzk2aea7x 6

29/05/2023, 21:40

230529-1h82paea7s 1

Analysis

max time kernel
1623s
max time network
1627s
platform
windows7_x64
resource
win7-20230220-en
resource tags

arch:x64arch:x86image:win7-20230220-enlocale:en-usos:windows7-x64system
submitted
29/05/2023, 21:43

Sharing

Report Analysis Logs

General

Target

scripts/scan_driver_packs.bat
Size

945B
MD5

2dbc6fd7355358866c8face4168a18ac
SHA1

80d767ff1d5ea1ac022cf2c213fd2583742734e9
SHA256

7c78826b30c054d407037d41368a40fabef133f1c83348290f0d756e05141e16
SHA512

e71c31e53429e9dd4eb9a02124a0867d10c96c275ecfcd1fd8e1e82f1f6bca82fa7b6d2c65ec3c27749a2f43028600286daf53b65421b67ffcc4335f888666cc

Score

1^/10

Malware Config

Signatures

Suspicious use of WriteProcessMemory 6 IoCs

description	pid	Process	procid_target
PID 1324 wrote to memory of 928	1324	cmd.exe	29
PID 1324 wrote to memory of 928	1324	cmd.exe	29
PID 1324 wrote to memory of 928	1324	cmd.exe	29
PID 1324 wrote to memory of 1288	1324	cmd.exe	30
PID 1324 wrote to memory of 1288	1324	cmd.exe	30
PID 1324 wrote to memory of 1288	1324	cmd.exe	30

C:\Windows\system32\cmd.exe
cmd /c "C:\Users\Admin\AppData\Local\Temp\scripts\scan_driver_packs.bat"
1⤵
- Suspicious use of WriteProcessMemory
PID:1324
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c dir /b /od "C:\Users\Admin\AppData\Local\Temp\scripts\SDIO_R*.exe"
  2⤵
  PID:928
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c dir /b drivers\*.7z
  2⤵
  PID:1288

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads