67597b2f06c2fef4c71c99a3932139cc18a443efccea433255746283e3cc5a45

Resubmissions

01/06/2023, 10:29

230601-mjktladg55 1

01/06/2023, 10:28

230601-mh61fadg52 1

01/06/2023, 10:27

230601-mhek7aeb9z 1

Analysis

max time kernel
91s
max time network
127s
platform
windows10-2004_x64
resource
win10v2004-20230220-en
resource tags

arch:x64arch:x86image:win10v2004-20230220-enlocale:en-usos:windows10-2004-x64system
submitted
01/06/2023, 10:29

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

morsáč.bat
Size

1KB
MD5

4c1d9925cce58ee333d062a3b51e010a
SHA1

9073d20384407b99a6a7447613392760c4b0814b
SHA256

67597b2f06c2fef4c71c99a3932139cc18a443efccea433255746283e3cc5a45
SHA512

e02599d02c879d15bf04fcb20560b2e99ff58b1c0e7be43e81ffcb3ab2f851a396778012c4b22a4bbb6911cfb91e2b965cb5714550f539017ddf6c319f638950

Score

1^/10

Malware Config

Signatures

Suspicious use of WriteProcessMemory 36 IoCs

description	pid	Process	procid_target
PID 1020 wrote to memory of 4396	1020	cmd.exe	84
PID 1020 wrote to memory of 4396	1020	cmd.exe	84
PID 4396 wrote to memory of 4884	4396	cmd.exe	85
PID 4396 wrote to memory of 4884	4396	cmd.exe	85
PID 1020 wrote to memory of 4544	1020	cmd.exe	86
PID 1020 wrote to memory of 4544	1020	cmd.exe	86
PID 4544 wrote to memory of 2968	4544	cmd.exe	87
PID 4544 wrote to memory of 2968	4544	cmd.exe	87
PID 1020 wrote to memory of 1028	1020	cmd.exe	88
PID 1020 wrote to memory of 1028	1020	cmd.exe	88
PID 1028 wrote to memory of 1256	1028	cmd.exe	92
PID 1028 wrote to memory of 1256	1028	cmd.exe	92
PID 1020 wrote to memory of 4288	1020	cmd.exe	91
PID 1020 wrote to memory of 4288	1020	cmd.exe	91
PID 4288 wrote to memory of 4892	4288	cmd.exe	90
PID 4288 wrote to memory of 4892	4288	cmd.exe	90
PID 1020 wrote to memory of 4300	1020	cmd.exe	89
PID 1020 wrote to memory of 4300	1020	cmd.exe	89
PID 4300 wrote to memory of 1968	4300	cmd.exe	93
PID 4300 wrote to memory of 1968	4300	cmd.exe	93
PID 1020 wrote to memory of 2004	1020	cmd.exe	94
PID 1020 wrote to memory of 2004	1020	cmd.exe	94
PID 2004 wrote to memory of 4388	2004	cmd.exe	95
PID 2004 wrote to memory of 4388	2004	cmd.exe	95
PID 1020 wrote to memory of 636	1020	cmd.exe	96
PID 1020 wrote to memory of 636	1020	cmd.exe	96
PID 636 wrote to memory of 1724	636	cmd.exe	97
PID 636 wrote to memory of 1724	636	cmd.exe	97
PID 1020 wrote to memory of 3592	1020	cmd.exe	98
PID 1020 wrote to memory of 3592	1020	cmd.exe	98
PID 3592 wrote to memory of 2976	3592	cmd.exe	99
PID 3592 wrote to memory of 2976	3592	cmd.exe	99
PID 1020 wrote to memory of 3560	1020	cmd.exe	100
PID 1020 wrote to memory of 3560	1020	cmd.exe	100
PID 3560 wrote to memory of 732	3560	cmd.exe	101
PID 3560 wrote to memory of 732	3560	cmd.exe	101

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\morsáč.bat"
1⤵
- Suspicious use of WriteProcessMemory
PID:1020
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c findstr /b /c:". " "C:\Users\Admin\AppData\Local\Temp\morsáč.bat"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:4396
- - C:\Windows\system32\findstr.exe
    findstr /b /c:". " "C:\Users\Admin\AppData\Local\Temp\morsáč.bat"
    3⤵
    PID:4884
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c findstr /b /c:".-.. " "C:\Users\Admin\AppData\Local\Temp\morsáč.bat"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:4544
- - C:\Windows\system32\findstr.exe
    findstr /b /c:".-.. " "C:\Users\Admin\AppData\Local\Temp\morsáč.bat"
    3⤵
    PID:2968
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c findstr /b /c:".-.. " "C:\Users\Admin\AppData\Local\Temp\morsáč.bat"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1028
- - C:\Windows\system32\findstr.exe
    findstr /b /c:".-.. " "C:\Users\Admin\AppData\Local\Temp\morsáč.bat"
    3⤵
    PID:1256
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c findstr /b /c:".-- " "C:\Users\Admin\AppData\Local\Temp\morsáč.bat"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:4300
- - C:\Windows\system32\findstr.exe
    findstr /b /c:".-- " "C:\Users\Admin\AppData\Local\Temp\morsáč.bat"
    3⤵
    PID:1968
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c findstr /b /c:"--- " "C:\Users\Admin\AppData\Local\Temp\morsáč.bat"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:4288
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c findstr /b /c:"--- " "C:\Users\Admin\AppData\Local\Temp\morsáč.bat"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2004
- - C:\Windows\system32\findstr.exe
    findstr /b /c:"--- " "C:\Users\Admin\AppData\Local\Temp\morsáč.bat"
    3⤵
    PID:4388
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c findstr /b /c:".-. " "C:\Users\Admin\AppData\Local\Temp\morsáč.bat"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:636
- - C:\Windows\system32\findstr.exe
    findstr /b /c:".-. " "C:\Users\Admin\AppData\Local\Temp\morsáč.bat"
    3⤵
    PID:1724
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c findstr /b /c:".-.. " "C:\Users\Admin\AppData\Local\Temp\morsáč.bat"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:3592
- - C:\Windows\system32\findstr.exe
    findstr /b /c:".-.. " "C:\Users\Admin\AppData\Local\Temp\morsáč.bat"
    3⤵
    PID:2976
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c findstr /b /c:"-.. " "C:\Users\Admin\AppData\Local\Temp\morsáč.bat"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:3560
- - C:\Windows\system32\findstr.exe
    findstr /b /c:"-.. " "C:\Users\Admin\AppData\Local\Temp\morsáč.bat"
    3⤵
    PID:732

C:\Windows\system32\findstr.exe
findstr /b /c:"--- " "C:\Users\Admin\AppData\Local\Temp\morsáč.bat"
1⤵
PID:4892

Windows 7 deprecation

Loading Replay Monitor...

Resubmissions

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads