67597b2f06c2fef4c71c99a3932139cc18a443efccea433255746283e3cc5a45

Resubmissions

01/06/2023, 10:29

230601-mjktladg55 1

01/06/2023, 10:28

230601-mh61fadg52 1

01/06/2023, 10:27

230601-mhek7aeb9z 1

Analysis

max time kernel
31s
max time network
33s
platform
windows7_x64
resource
win7-20230220-en
resource tags

arch:x64arch:x86image:win7-20230220-enlocale:en-usos:windows7-x64system
submitted
01/06/2023, 10:29

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

morsáč.bat
Size

1KB
MD5

4c1d9925cce58ee333d062a3b51e010a
SHA1

9073d20384407b99a6a7447613392760c4b0814b
SHA256

67597b2f06c2fef4c71c99a3932139cc18a443efccea433255746283e3cc5a45
SHA512

e02599d02c879d15bf04fcb20560b2e99ff58b1c0e7be43e81ffcb3ab2f851a396778012c4b22a4bbb6911cfb91e2b965cb5714550f539017ddf6c319f638950

Score

1^/10

Malware Config

Signatures

Suspicious use of WriteProcessMemory 54 IoCs

description	pid	Process	procid_target
PID 1424 wrote to memory of 1420	1424	cmd.exe	29
PID 1424 wrote to memory of 1420	1424	cmd.exe	29
PID 1424 wrote to memory of 1420	1424	cmd.exe	29
PID 1420 wrote to memory of 316	1420	cmd.exe	30
PID 1420 wrote to memory of 316	1420	cmd.exe	30
PID 1420 wrote to memory of 316	1420	cmd.exe	30
PID 1424 wrote to memory of 908	1424	cmd.exe	31
PID 1424 wrote to memory of 908	1424	cmd.exe	31
PID 1424 wrote to memory of 908	1424	cmd.exe	31
PID 908 wrote to memory of 1312	908	cmd.exe	32
PID 908 wrote to memory of 1312	908	cmd.exe	32
PID 908 wrote to memory of 1312	908	cmd.exe	32
PID 1424 wrote to memory of 1320	1424	cmd.exe	33
PID 1424 wrote to memory of 1320	1424	cmd.exe	33
PID 1424 wrote to memory of 1320	1424	cmd.exe	33
PID 1320 wrote to memory of 2016	1320	cmd.exe	34
PID 1320 wrote to memory of 2016	1320	cmd.exe	34
PID 1320 wrote to memory of 2016	1320	cmd.exe	34
PID 1424 wrote to memory of 1808	1424	cmd.exe	35
PID 1424 wrote to memory of 1808	1424	cmd.exe	35
PID 1424 wrote to memory of 1808	1424	cmd.exe	35
PID 1808 wrote to memory of 1528	1808	cmd.exe	36
PID 1808 wrote to memory of 1528	1808	cmd.exe	36
PID 1808 wrote to memory of 1528	1808	cmd.exe	36
PID 1424 wrote to memory of 1516	1424	cmd.exe	37
PID 1424 wrote to memory of 1516	1424	cmd.exe	37
PID 1424 wrote to memory of 1516	1424	cmd.exe	37
PID 1516 wrote to memory of 276	1516	cmd.exe	38
PID 1516 wrote to memory of 276	1516	cmd.exe	38
PID 1516 wrote to memory of 276	1516	cmd.exe	38
PID 1424 wrote to memory of 916	1424	cmd.exe	39
PID 1424 wrote to memory of 916	1424	cmd.exe	39
PID 1424 wrote to memory of 916	1424	cmd.exe	39
PID 916 wrote to memory of 1504	916	cmd.exe	40
PID 916 wrote to memory of 1504	916	cmd.exe	40
PID 916 wrote to memory of 1504	916	cmd.exe	40
PID 1424 wrote to memory of 676	1424	cmd.exe	41
PID 1424 wrote to memory of 676	1424	cmd.exe	41
PID 1424 wrote to memory of 676	1424	cmd.exe	41
PID 676 wrote to memory of 468	676	cmd.exe	42
PID 676 wrote to memory of 468	676	cmd.exe	42
PID 676 wrote to memory of 468	676	cmd.exe	42
PID 1424 wrote to memory of 972	1424	cmd.exe	43
PID 1424 wrote to memory of 972	1424	cmd.exe	43
PID 1424 wrote to memory of 972	1424	cmd.exe	43
PID 972 wrote to memory of 1632	972	cmd.exe	44
PID 972 wrote to memory of 1632	972	cmd.exe	44
PID 972 wrote to memory of 1632	972	cmd.exe	44
PID 1424 wrote to memory of 1088	1424	cmd.exe	45
PID 1424 wrote to memory of 1088	1424	cmd.exe	45
PID 1424 wrote to memory of 1088	1424	cmd.exe	45
PID 1088 wrote to memory of 1624	1088	cmd.exe	46
PID 1088 wrote to memory of 1624	1088	cmd.exe	46
PID 1088 wrote to memory of 1624	1088	cmd.exe	46

C:\Windows\system32\cmd.exe
cmd /c "C:\Users\Admin\AppData\Local\Temp\morsáč.bat"
1⤵
- Suspicious use of WriteProcessMemory
PID:1424
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c findstr /b /c:". " "C:\Users\Admin\AppData\Local\Temp\morsáč.bat"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1420
- - C:\Windows\system32\findstr.exe
    findstr /b /c:". " "C:\Users\Admin\AppData\Local\Temp\morsáč.bat"
    3⤵
    PID:316
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c findstr /b /c:".-.. " "C:\Users\Admin\AppData\Local\Temp\morsáč.bat"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:908
- - C:\Windows\system32\findstr.exe
    findstr /b /c:".-.. " "C:\Users\Admin\AppData\Local\Temp\morsáč.bat"
    3⤵
    PID:1312
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c findstr /b /c:".-.. " "C:\Users\Admin\AppData\Local\Temp\morsáč.bat"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1320
- - C:\Windows\system32\findstr.exe
    findstr /b /c:".-.. " "C:\Users\Admin\AppData\Local\Temp\morsáč.bat"
    3⤵
    PID:2016
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c findstr /b /c:"--- " "C:\Users\Admin\AppData\Local\Temp\morsáč.bat"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1808
- - C:\Windows\system32\findstr.exe
    findstr /b /c:"--- " "C:\Users\Admin\AppData\Local\Temp\morsáč.bat"
    3⤵
    PID:1528
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c findstr /b /c:".-- " "C:\Users\Admin\AppData\Local\Temp\morsáč.bat"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1516
- - C:\Windows\system32\findstr.exe
    findstr /b /c:".-- " "C:\Users\Admin\AppData\Local\Temp\morsáč.bat"
    3⤵
    PID:276
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c findstr /b /c:"--- " "C:\Users\Admin\AppData\Local\Temp\morsáč.bat"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:916
- - C:\Windows\system32\findstr.exe
    findstr /b /c:"--- " "C:\Users\Admin\AppData\Local\Temp\morsáč.bat"
    3⤵
    PID:1504
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c findstr /b /c:".-. " "C:\Users\Admin\AppData\Local\Temp\morsáč.bat"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:676
- - C:\Windows\system32\findstr.exe
    findstr /b /c:".-. " "C:\Users\Admin\AppData\Local\Temp\morsáč.bat"
    3⤵
    PID:468
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c findstr /b /c:".-.. " "C:\Users\Admin\AppData\Local\Temp\morsáč.bat"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:972
- - C:\Windows\system32\findstr.exe
    findstr /b /c:".-.. " "C:\Users\Admin\AppData\Local\Temp\morsáč.bat"
    3⤵
    PID:1632
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c findstr /b /c:"-.. " "C:\Users\Admin\AppData\Local\Temp\morsáč.bat"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1088
- - C:\Windows\system32\findstr.exe
    findstr /b /c:"-.. " "C:\Users\Admin\AppData\Local\Temp\morsáč.bat"
    3⤵
    PID:1624

Windows 7 deprecation

Loading Replay Monitor...

Resubmissions

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads