642794e8415fc859867b3e8beadaad98f26f40abd70ae74ca4be632d958fffd2 | Triage

Analysis

max time kernel
119s
max time network
123s
platform
windows7_x64
resource
win7-20230831-en
resource tags

arch:x64arch:x86image:win7-20230831-enlocale:en-usos:windows7-x64system
submitted
19/09/2023, 11:08

Sharing

Report Analysis Logs

General

Target

____÷5.bat
Size

76KB
MD5

84f37c18e6686987788d404d8f2485c5
SHA1

743b6a9bffb8e3717831f7d0d479b3993f398c31
SHA256

642794e8415fc859867b3e8beadaad98f26f40abd70ae74ca4be632d958fffd2
SHA512

a596326a82fe651bd10529370eeeb6afd0a9902c32b8d7c3f46a97f82fb6f72df066f8cf753beecff68d8db1febc49df7dd86949df29143917209e549fbfd69a
SSDEEP

384:2mB1m9km92m9sm9km9Aml5mlomlumlSmlcmlsmlkmllmlZmjDmlfmn7mlJmlTmlA:rElL9lZcBn7Vl9oemQes2kZDx

Score

1^/10

Malware Config

Signatures

Kills process with taskkill 1 IoCs

pid	Process
2700	taskkill.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	2700	taskkill.exe

Suspicious use of WriteProcessMemory 9 IoCs

description	pid	Process	procid_target
PID 1476 wrote to memory of 2360	1476	cmd.exe	29
PID 1476 wrote to memory of 2360	1476	cmd.exe	29
PID 1476 wrote to memory of 2360	1476	cmd.exe	29
PID 1476 wrote to memory of 2700	1476	cmd.exe	30
PID 1476 wrote to memory of 2700	1476	cmd.exe	30
PID 1476 wrote to memory of 2700	1476	cmd.exe	30
PID 1476 wrote to memory of 2548	1476	cmd.exe	32
PID 1476 wrote to memory of 2548	1476	cmd.exe	32
PID 1476 wrote to memory of 2548	1476	cmd.exe	32

C:\Windows\system32\cmd.exe
cmd /c "C:\Users\Admin\AppData\Local\Temp\____÷5.bat"
1⤵
- Suspicious use of WriteProcessMemory
PID:1476
- C:\Windows\system32\mode.com
  mode con cols=107 lines=41
  2⤵
  PID:2360
- C:\Windows\system32\taskkill.exe
  taskkill /f /im explorer.exe
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:2700
- C:\Windows\system32\mode.com
  mode con cols=107 lines=41
  2⤵
  PID:2548

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads