Analysis
-
max time kernel
118s -
max time network
121s -
platform
windows7_x64 -
resource
win7-20230831-en -
resource tags
arch:x64arch:x86image:win7-20230831-enlocale:en-usos:windows7-x64system -
submitted
19/09/2023, 06:13
Static task
static1
Behavioral task
behavioral1
Sample
_.bat
Resource
win7-20230831-en
windows7-x64
2 signatures
150 seconds
Behavioral task
behavioral2
Sample
_.bat
Resource
win10v2004-20230915-en
windows10-2004-x64
2 signatures
150 seconds
General
-
Target
_.bat
-
Size
1008B
-
MD5
a321fe09835442a34e675343a6fc2704
-
SHA1
d4d6672df5e79c4cb62909ad55e1128f72c2bab6
-
SHA256
ec40b02808d3d26c4ea23a27aff75f2ae1ea4ae9ae3e6854140efffcedb4a1c1
-
SHA512
57e4f316f1447e0b042b399ea7e88e9615db96e97712f8aaa5bbc62ee80404841ff3a1af46fc3ed8de3c5ea02eea7a7ead62a7c8e8c567ddebec73f78efc526d
Score
7/10
Malware Config
Signatures
-
Drops startup file 2 IoCs
description ioc Process File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\_.bat cmd.exe File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\_.bat cmd.exe -
Suspicious use of WriteProcessMemory 54 IoCs
description pid Process procid_target PID 488 wrote to memory of 1400 488 cmd.exe 29 PID 488 wrote to memory of 1400 488 cmd.exe 29 PID 488 wrote to memory of 1400 488 cmd.exe 29 PID 488 wrote to memory of 2368 488 cmd.exe 30 PID 488 wrote to memory of 2368 488 cmd.exe 30 PID 488 wrote to memory of 2368 488 cmd.exe 30 PID 488 wrote to memory of 2304 488 cmd.exe 31 PID 488 wrote to memory of 2304 488 cmd.exe 31 PID 488 wrote to memory of 2304 488 cmd.exe 31 PID 488 wrote to memory of 2280 488 cmd.exe 32 PID 488 wrote to memory of 2280 488 cmd.exe 32 PID 488 wrote to memory of 2280 488 cmd.exe 32 PID 488 wrote to memory of 1164 488 cmd.exe 33 PID 488 wrote to memory of 1164 488 cmd.exe 33 PID 488 wrote to memory of 1164 488 cmd.exe 33 PID 488 wrote to memory of 632 488 cmd.exe 34 PID 488 wrote to memory of 632 488 cmd.exe 34 PID 488 wrote to memory of 632 488 cmd.exe 34 PID 488 wrote to memory of 2956 488 cmd.exe 35 PID 488 wrote to memory of 2956 488 cmd.exe 35 PID 488 wrote to memory of 2956 488 cmd.exe 35 PID 488 wrote to memory of 1708 488 cmd.exe 36 PID 488 wrote to memory of 1708 488 cmd.exe 36 PID 488 wrote to memory of 1708 488 cmd.exe 36 PID 488 wrote to memory of 2844 488 cmd.exe 37 PID 488 wrote to memory of 2844 488 cmd.exe 37 PID 488 wrote to memory of 2844 488 cmd.exe 37 PID 488 wrote to memory of 2096 488 cmd.exe 38 PID 488 wrote to memory of 2096 488 cmd.exe 38 PID 488 wrote to memory of 2096 488 cmd.exe 38 PID 488 wrote to memory of 2288 488 cmd.exe 39 PID 488 wrote to memory of 2288 488 cmd.exe 39 PID 488 wrote to memory of 2288 488 cmd.exe 39 PID 488 wrote to memory of 1904 488 cmd.exe 40 PID 488 wrote to memory of 1904 488 cmd.exe 40 PID 488 wrote to memory of 1904 488 cmd.exe 40 PID 488 wrote to memory of 2340 488 cmd.exe 41 PID 488 wrote to memory of 2340 488 cmd.exe 41 PID 488 wrote to memory of 2340 488 cmd.exe 41 PID 488 wrote to memory of 2336 488 cmd.exe 42 PID 488 wrote to memory of 2336 488 cmd.exe 42 PID 488 wrote to memory of 2336 488 cmd.exe 42 PID 488 wrote to memory of 2668 488 cmd.exe 43 PID 488 wrote to memory of 2668 488 cmd.exe 43 PID 488 wrote to memory of 2668 488 cmd.exe 43 PID 488 wrote to memory of 2672 488 cmd.exe 44 PID 488 wrote to memory of 2672 488 cmd.exe 44 PID 488 wrote to memory of 2672 488 cmd.exe 44 PID 488 wrote to memory of 2784 488 cmd.exe 45 PID 488 wrote to memory of 2784 488 cmd.exe 45 PID 488 wrote to memory of 2784 488 cmd.exe 45 PID 488 wrote to memory of 2788 488 cmd.exe 46 PID 488 wrote to memory of 2788 488 cmd.exe 46 PID 488 wrote to memory of 2788 488 cmd.exe 46
Processes
-
C:\Windows\system32\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\_.bat"1⤵
- Drops startup file
- Suspicious use of WriteProcessMemory
PID:488 -
C:\Windows\system32\certutil.execertutil -encode *.DOC encoded.doc2⤵PID:1400
-
-
C:\Windows\system32\certutil.execertutil -encode *.JPEG encoded.jpeg2⤵PID:2368
-
-
C:\Windows\system32\certutil.execertutil -encode *.LNK encoded.lnk2⤵PID:2304
-
-
C:\Windows\system32\certutil.execertutil -encode *.AVI encoded.avi2⤵PID:2280
-
-
C:\Windows\system32\certutil.execertutil -encode *.MPEG encoded.mpeg2⤵PID:1164
-
-
C:\Windows\system32\certutil.execertutil -encode *.COM encoded.com2⤵PID:632
-
-
C:\Windows\system32\certutil.execertutil -encode *.BAT encoded.bat2⤵PID:2956
-
-
C:\Windows\system32\certutil.execertutil -encode *.MP3 encoded.mp32⤵PID:1708
-
-
C:\Windows\system32\certutil.execertutil -encode *.MP4 encoded.mp42⤵PID:2844
-
-
C:\Windows\system32\certutil.execertutil -encode *.CSV encoded.csv2⤵PID:2096
-
-
C:\Windows\system32\certutil.execertutil -encode *.PDF encoded.pdf2⤵PID:2288
-
-
C:\Windows\system32\certutil.execertutil -encode *.EXE encoded.exe2⤵PID:1904
-
-
C:\Windows\system32\certutil.execertutil -encode *.PNG encoded.png2⤵PID:2340
-
-
C:\Windows\system32\certutil.execertutil -encode *.WAV encoded.wav2⤵PID:2336
-
-
C:\Windows\system32\certutil.execertutil -encode *.PSD encoded.psd2⤵PID:2668
-
-
C:\Windows\system32\certutil.execertutil -encode *.MOV encoded.mov2⤵PID:2672
-
-
C:\Windows\system32\certutil.execertutil -encode *.RAR encoded.rar2⤵PID:2784
-
-
C:\Windows\system32\certutil.execertutil -encode *.PFA encoded.pfa2⤵PID:2788
-