67597b2f06c2fef4c71c99a3932139cc18a443efccea433255746283e3cc5a45

Resubmissions

01/06/2023, 10:29

230601-mjktladg55 1

01/06/2023, 10:28

230601-mh61fadg52 1

01/06/2023, 10:27

230601-mhek7aeb9z 1

Analysis

max time kernel
13s
max time network
15s
platform
windows10-2004_x64
resource
win10v2004-20230221-en
resource tags

arch:x64arch:x86image:win10v2004-20230221-enlocale:en-usos:windows10-2004-x64system
submitted
01/06/2023, 10:28

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

morsáč.bat
Size

1KB
MD5

4c1d9925cce58ee333d062a3b51e010a
SHA1

9073d20384407b99a6a7447613392760c4b0814b
SHA256

67597b2f06c2fef4c71c99a3932139cc18a443efccea433255746283e3cc5a45
SHA512

e02599d02c879d15bf04fcb20560b2e99ff58b1c0e7be43e81ffcb3ab2f851a396778012c4b22a4bbb6911cfb91e2b965cb5714550f539017ddf6c319f638950

Score

1^/10

Malware Config

Signatures

Suspicious use of WriteProcessMemory 36 IoCs

description	pid	Process	procid_target
PID 1120 wrote to memory of 804	1120	cmd.exe	86
PID 1120 wrote to memory of 804	1120	cmd.exe	86
PID 804 wrote to memory of 1944	804	cmd.exe	87
PID 804 wrote to memory of 1944	804	cmd.exe	87
PID 1120 wrote to memory of 4736	1120	cmd.exe	88
PID 1120 wrote to memory of 4736	1120	cmd.exe	88
PID 4736 wrote to memory of 1624	4736	cmd.exe	89
PID 4736 wrote to memory of 1624	4736	cmd.exe	89
PID 1120 wrote to memory of 1056	1120	cmd.exe	91
PID 1120 wrote to memory of 1056	1120	cmd.exe	91
PID 1056 wrote to memory of 1700	1056	cmd.exe	90
PID 1056 wrote to memory of 1700	1056	cmd.exe	90
PID 1120 wrote to memory of 2152	1120	cmd.exe	92
PID 1120 wrote to memory of 2152	1120	cmd.exe	92
PID 2152 wrote to memory of 3640	2152	cmd.exe	93
PID 2152 wrote to memory of 3640	2152	cmd.exe	93
PID 1120 wrote to memory of 3932	1120	cmd.exe	94
PID 1120 wrote to memory of 3932	1120	cmd.exe	94
PID 3932 wrote to memory of 2692	3932	cmd.exe	95
PID 3932 wrote to memory of 2692	3932	cmd.exe	95
PID 1120 wrote to memory of 2724	1120	cmd.exe	96
PID 1120 wrote to memory of 2724	1120	cmd.exe	96
PID 2724 wrote to memory of 2672	2724	cmd.exe	97
PID 2724 wrote to memory of 2672	2724	cmd.exe	97
PID 1120 wrote to memory of 2984	1120	cmd.exe	98
PID 1120 wrote to memory of 2984	1120	cmd.exe	98
PID 2984 wrote to memory of 348	2984	cmd.exe	99
PID 2984 wrote to memory of 348	2984	cmd.exe	99
PID 1120 wrote to memory of 320	1120	cmd.exe	100
PID 1120 wrote to memory of 320	1120	cmd.exe	100
PID 320 wrote to memory of 220	320	cmd.exe	101
PID 320 wrote to memory of 220	320	cmd.exe	101
PID 1120 wrote to memory of 3908	1120	cmd.exe	102
PID 1120 wrote to memory of 3908	1120	cmd.exe	102
PID 3908 wrote to memory of 1460	3908	cmd.exe	103
PID 3908 wrote to memory of 1460	3908	cmd.exe	103

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\morsáč.bat"
1⤵
- Suspicious use of WriteProcessMemory
PID:1120
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c findstr /b /c:". " "C:\Users\Admin\AppData\Local\Temp\morsáč.bat"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:804
- - C:\Windows\system32\findstr.exe
    findstr /b /c:". " "C:\Users\Admin\AppData\Local\Temp\morsáč.bat"
    3⤵
    PID:1944
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c findstr /b /c:".-.. " "C:\Users\Admin\AppData\Local\Temp\morsáč.bat"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:4736
- - C:\Windows\system32\findstr.exe
    findstr /b /c:".-.. " "C:\Users\Admin\AppData\Local\Temp\morsáč.bat"
    3⤵
    PID:1624
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c findstr /b /c:".-.. " "C:\Users\Admin\AppData\Local\Temp\morsáč.bat"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1056
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c findstr /b /c:"--- " "C:\Users\Admin\AppData\Local\Temp\morsáč.bat"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2152
- - C:\Windows\system32\findstr.exe
    findstr /b /c:"--- " "C:\Users\Admin\AppData\Local\Temp\morsáč.bat"
    3⤵
    PID:3640
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c findstr /b /c:".-- " "C:\Users\Admin\AppData\Local\Temp\morsáč.bat"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:3932
- - C:\Windows\system32\findstr.exe
    findstr /b /c:".-- " "C:\Users\Admin\AppData\Local\Temp\morsáč.bat"
    3⤵
    PID:2692
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c findstr /b /c:"--- " "C:\Users\Admin\AppData\Local\Temp\morsáč.bat"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2724
- - C:\Windows\system32\findstr.exe
    findstr /b /c:"--- " "C:\Users\Admin\AppData\Local\Temp\morsáč.bat"
    3⤵
    PID:2672
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c findstr /b /c:".-. " "C:\Users\Admin\AppData\Local\Temp\morsáč.bat"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2984
- - C:\Windows\system32\findstr.exe
    findstr /b /c:".-. " "C:\Users\Admin\AppData\Local\Temp\morsáč.bat"
    3⤵
    PID:348
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c findstr /b /c:".-.. " "C:\Users\Admin\AppData\Local\Temp\morsáč.bat"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:320
- - C:\Windows\system32\findstr.exe
    findstr /b /c:".-.. " "C:\Users\Admin\AppData\Local\Temp\morsáč.bat"
    3⤵
    PID:220
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c findstr /b /c:"-.. " "C:\Users\Admin\AppData\Local\Temp\morsáč.bat"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:3908
- - C:\Windows\system32\findstr.exe
    findstr /b /c:"-.. " "C:\Users\Admin\AppData\Local\Temp\morsáč.bat"
    3⤵
    PID:1460

C:\Windows\system32\findstr.exe
findstr /b /c:".-.. " "C:\Users\Admin\AppData\Local\Temp\morsáč.bat"
1⤵
PID:1700

Windows 7 deprecation

Loading Replay Monitor...

Resubmissions

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads