66d933492b04817c8407992676f09e3c7451c93b6902616b738153d3d41bc6a2 | Triage

Resubmissions

20/08/2023, 21:19

230820-z6hzqsbb31 1

18/08/2023, 14:29

230818-rtpyhsca8s 10

Analysis

max time kernel
117s
max time network
120s
platform
windows7_x64
resource
win7-20230712-en
resource tags

arch:x64arch:x86image:win7-20230712-enlocale:en-usos:windows7-x64system
submitted
20/08/2023, 21:19

Sharing

Report Analysis Logs

General

Target

file.bat
Size

53B
MD5

b6fd5928246a15c4f4f41bbe0e9f6580
SHA1

dc91b7626c6edc9cf56c21bf989e688331d2ff72
SHA256

66d933492b04817c8407992676f09e3c7451c93b6902616b738153d3d41bc6a2
SHA512

f5a15a8b4568f2cb3641be8ad9cf071584365cd52b93ca8efbb24daed3b26c43e4272606c9607a3647628d707537f6a6b62908dc601f4ecd0cec1072f4f5fbb9

Score

1^/10

Malware Config

Signatures

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2508 wrote to memory of 2536	2508	cmd.exe	29
PID 2508 wrote to memory of 2536	2508	cmd.exe	29
PID 2508 wrote to memory of 2536	2508	cmd.exe	29

C:\Windows\system32\cmd.exe
cmd /c "C:\Users\Admin\AppData\Local\Temp\file.bat"
1⤵
- Suspicious use of WriteProcessMemory
PID:2508
- C:\Windows\system32\reg.exe
  reg delete HKEY_LOCAL_MACHINE\system
  2⤵
  PID:2536

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads