c24c4d805947b473c5f9abf3fa3b2168b1aaf8b282d612d004fd60774da49193

Resubmissions

29/05/2023, 21:43

230529-1kzk2aea7x 6

29/05/2023, 21:40

230529-1h82paea7s 1

Analysis

max time kernel
1616s
max time network
1619s
platform
windows7_x64
resource
win7-20230220-en
resource tags

arch:x64arch:x86image:win7-20230220-enlocale:en-usos:windows7-x64system
submitted
29/05/2023, 21:43

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

del_old_driverpacks.bat
Size

1KB
MD5

059a48f88d38595b3d4fe63d78b509f0
SHA1

5acf13baa930f384227f5d59371491787ebf97c7
SHA256

6d74ad1de33394216a6fd1ffb58e87d90a399bdafa8d2ac223e2377ec5947859
SHA512

397eca1cf2f830316cd39296b5b9015938f777b8e26f00c8ee0ff95639dcbf097e55586c35dbeb5b559d7e17ff90203d396f13a1524bc24b153186005f9f4b5b

Score

5^/10

Malware Config

Signatures

Drops autorun.inf file 1 TTPs 1 IoCs

Malware can abuse Windows Autorun to spread further via attached volumes.

Replication Through Removable Media

T1091

description	ioc	Process
File opened for modification	C:\Users\Admin\AppData\Local\Temp\autorun.inf	attrib.exe

Suspicious use of WriteProcessMemory 6 IoCs

description	pid	Process	procid_target
PID 996 wrote to memory of 852	996	cmd.exe	29
PID 996 wrote to memory of 852	996	cmd.exe	29
PID 996 wrote to memory of 852	996	cmd.exe	29
PID 996 wrote to memory of 836	996	cmd.exe	30
PID 996 wrote to memory of 836	996	cmd.exe	30
PID 996 wrote to memory of 836	996	cmd.exe	30

Views/modifies file attributes 1 TTPs 1 IoCs

evasion

Hidden Files and Directories

T1158

pid	Process
852	attrib.exe

C:\Windows\system32\cmd.exe
cmd /c "C:\Users\Admin\AppData\Local\Temp\del_old_driverpacks.bat"
1⤵
- Suspicious use of WriteProcessMemory
PID:996
- C:\Windows\system32\attrib.exe
  attrib *.* -R
  2⤵
  - Drops autorun.inf file
  - Views/modifies file attributes
  PID:852
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c dir /b *.7z
  2⤵
  PID:836

Network

MITRE ATT&CK Enterprise v6

Initial Access

Replication Through Removable Media

T1091

Execution

Persistence

Hidden Files and Directories

T1158

Privilege Escalation

Defense Evasion

Hidden Files and Directories

T1158

Credential Access

Discovery

Lateral Movement

Replication Through Removable Media

T1091

Collection

Command and Control

Exfiltration

Impact

Resubmissions

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads