642794e8415fc859867b3e8beadaad98f26f40abd70ae74ca4be632d958fffd2 | Triage

Analysis

max time kernel
142s
max time network
147s
platform
windows10-2004_x64
resource
win10v2004-20230915-en
resource tags

arch:x64arch:x86image:win10v2004-20230915-enlocale:en-usos:windows10-2004-x64system
submitted
19-09-2023 11:08

Sharing

Report Analysis Logs

General

Target

____÷5.bat
Size

76KB
MD5

84f37c18e6686987788d404d8f2485c5
SHA1

743b6a9bffb8e3717831f7d0d479b3993f398c31
SHA256

642794e8415fc859867b3e8beadaad98f26f40abd70ae74ca4be632d958fffd2
SHA512

a596326a82fe651bd10529370eeeb6afd0a9902c32b8d7c3f46a97f82fb6f72df066f8cf753beecff68d8db1febc49df7dd86949df29143917209e549fbfd69a
SSDEEP

384:2mB1m9km92m9sm9km9Aml5mlomlumlSmlcmlsmlkmllmlZmjDmlfmn7mlJmlTmlA:rElL9lZcBn7Vl9oemQes2kZDx

Score

1^/10

Malware Config

Signatures

Kills process with taskkill 1 IoCs

pid	Process
2036	taskkill.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	2036	taskkill.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 3240 wrote to memory of 4756	3240	cmd.exe	86
PID 3240 wrote to memory of 4756	3240	cmd.exe	86
PID 3240 wrote to memory of 2036	3240	cmd.exe	90
PID 3240 wrote to memory of 2036	3240	cmd.exe	90

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\____÷5.bat"
1⤵
- Suspicious use of WriteProcessMemory
PID:3240
- C:\Windows\system32\mode.com
  mode con cols=107 lines=41
  2⤵
  PID:4756
- C:\Windows\system32\taskkill.exe
  taskkill /f /im explorer.exe
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:2036

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads