4f921e394fcb5e3ff35874558589e1084d9758f15e24f2f43698e5b315a54f76 | Triage

Analysis

max time kernel
137s
max time network
148s
platform
windows10-2004_x64
resource
win10v2004-20230824-en
resource tags

arch:x64arch:x86image:win10v2004-20230824-enlocale:en-usos:windows10-2004-x64system
submitted
29/08/2023, 14:20

Sharing

Report Analysis Logs

General

Target

自动方式：官方warp自动设置端点.bat
Size

3KB
MD5

280bb93758d4422fa9b0ec061d0a909d
SHA1

22bc5c1689097c38a8ebcf40bdf0ea3205c1a2d2
SHA256

6be38f8bca5c602d06d7cda24ca12f0e1c8b9248f0fb06e3b3aaf7115667ff29
SHA512

be537c659d6dd9dc0411e4209e27f7a6c45af1e8bd1260361c9a73874228cefadc7083c490ee42ef86d568ca6ce8de64c6f2439052390af0ad289393d69281a7

Score

5^/10

Malware Config

Signatures

Drops file in System32 directory 1 IoCs

description	ioc	Process
File created	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\InstallService\{98AC5A3A-776F-45B0-891B-7007F6C0674A}.catalogItem	svchost.exe

Runs net.exe

Suspicious use of WriteProcessMemory 6 IoCs

description	pid	Process	procid_target
PID 3572 wrote to memory of 888	3572	cmd.exe	85
PID 3572 wrote to memory of 888	3572	cmd.exe	85
PID 3572 wrote to memory of 2164	3572	cmd.exe	86
PID 3572 wrote to memory of 2164	3572	cmd.exe	86
PID 2164 wrote to memory of 4120	2164	net.exe	87
PID 2164 wrote to memory of 4120	2164	net.exe	87

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\自动方式：官方warp自动设置端点.bat"
1⤵
- Suspicious use of WriteProcessMemory
PID:3572
- C:\Windows\system32\chcp.com
  chcp 936
  2⤵
  PID:888
- C:\Windows\system32\net.exe
  net session
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2164
- - C:\Windows\system32\net1.exe
    C:\Windows\system32\net1 session
    3⤵
    PID:4120

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k netsvcs -p
1⤵
- Drops file in System32 directory
PID:1964

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads