70e2cf3920a72c429c96b503aa8e988d2ae5d9a45fc0d0a0e825a090f989bf3f | Triage

Analysis

max time kernel
149s
max time network
125s
platform
windows10-2004_x64
resource
win10v2004-20230621-en
resource tags

arch:x64arch:x86image:win10v2004-20230621-enlocale:en-usos:windows10-2004-x64system
submitted
30-06-2023 10:47

Sharing

Report Analysis Logs

General

Target

testingfile.bat
Size

19B
MD5

584070eaae83e0f69216f0dcc5663e57
SHA1

5121563d4d83d08a1bd411e36ec505444b47dc59
SHA256

70e2cf3920a72c429c96b503aa8e988d2ae5d9a45fc0d0a0e825a090f989bf3f
SHA512

2fe6f4accacfeafcae316b2ae810e8c9dbbead4603ecf311026935f598db2c56fd6106704389917e96f729df41e160866cfc4e534e04799d78ed820c0e3f92c2

Score

5^/10

Malware Config

Signatures

Drops file in System32 directory 8 IoCs

description	ioc	Process
File created	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\InstallService\{FC48D58E-BC21-4349-885A-6FDF5A8E4E81}.catalogItem	svchost.exe
File created	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\InstallService\{E3277D7B-0ED3-48F6-B925-695202B1A899}.catalogItem	svchost.exe
File created	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\InstallService\{E06FD645-5A86-4EF3-88B2-6CF8C98C0715}.catalogItem	svchost.exe
File created	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\InstallService\{F70F68B0-186B-4954-8A77-8431F153E80D}.catalogItem	svchost.exe
File created	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\InstallService\{2DCAB30F-205A-4A69-8985-C1D97EB4D947}.catalogItem	svchost.exe
File created	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\InstallService\{CFFF1D3D-98AD-400C-B019-0E61EB5BA5EC}.catalogItem	svchost.exe
File created	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\InstallService\{A2C51267-9DAD-4679-9B9E-DD66E1F28A4A}.catalogItem	svchost.exe
File created	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\InstallService\{425C5C7D-CB60-4825-A4D0-45D791FA72E9}.catalogItem	svchost.exe

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\testingfile.bat"
1⤵
PID:1648

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k netsvcs -p
1⤵
- Drops file in System32 directory
PID:4196

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads