08a7be0887e79b230ade807b0cd4217b305e7744db096d614b1d512670dcb8b4

Analysis

max time kernel
174s
max time network
182s
platform
windows10-2004_x64
resource
win10v2004-20230915-en
resource tags

arch:x64arch:x86image:win10v2004-20230915-enlocale:en-usos:windows10-2004-x64system
submitted
11/10/2023, 14:52

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

close 5.bat
Size

2KB
MD5

340b825f5e52b5b8f046588880330343
SHA1

d840ba5349de2eea8f1c9a0c3513dc291fdc4917
SHA256

08a7be0887e79b230ade807b0cd4217b305e7744db096d614b1d512670dcb8b4
SHA512

f4601108da3d8c5bbb08d397d9d87220911858109d775d0860be9f57ada6c82595b51bc68f38031ba3147b4b0b19d560965fc7ee246babde665e2d7a0681de4e

Score

1^/10

Malware Config

Signatures

Delays execution with timeout.exe 23 IoCs

evasion

pid	Process
1560	timeout.exe
2676	timeout.exe
3956	timeout.exe
3080	timeout.exe
3376	timeout.exe
4112	timeout.exe
5032	timeout.exe
2548	timeout.exe
864	timeout.exe
2752	timeout.exe
4696	timeout.exe
456	timeout.exe
2576	timeout.exe
2816	timeout.exe
5012	timeout.exe
4560	timeout.exe
5064	timeout.exe
3980	timeout.exe
1048	timeout.exe
3716	timeout.exe
5100	timeout.exe
4368	timeout.exe
2808	timeout.exe

Suspicious use of WriteProcessMemory 50 IoCs

description	pid	Process	procid_target
PID 4436 wrote to memory of 4904	4436	cmd.exe	86
PID 4436 wrote to memory of 4904	4436	cmd.exe	86
PID 4436 wrote to memory of 1400	4436	cmd.exe	87
PID 4436 wrote to memory of 1400	4436	cmd.exe	87
PID 4436 wrote to memory of 4696	4436	cmd.exe	92
PID 4436 wrote to memory of 4696	4436	cmd.exe	92
PID 4436 wrote to memory of 456	4436	cmd.exe	95
PID 4436 wrote to memory of 456	4436	cmd.exe	95
PID 4436 wrote to memory of 2576	4436	cmd.exe	98
PID 4436 wrote to memory of 2576	4436	cmd.exe	98
PID 4436 wrote to memory of 5100	4436	cmd.exe	99
PID 4436 wrote to memory of 5100	4436	cmd.exe	99
PID 4436 wrote to memory of 3956	4436	cmd.exe	100
PID 4436 wrote to memory of 3956	4436	cmd.exe	100
PID 4436 wrote to memory of 4112	4436	cmd.exe	102
PID 4436 wrote to memory of 4112	4436	cmd.exe	102
PID 4436 wrote to memory of 3980	4436	cmd.exe	103
PID 4436 wrote to memory of 3980	4436	cmd.exe	103
PID 4436 wrote to memory of 5032	4436	cmd.exe	104
PID 4436 wrote to memory of 5032	4436	cmd.exe	104
PID 4436 wrote to memory of 2548	4436	cmd.exe	105
PID 4436 wrote to memory of 2548	4436	cmd.exe	105
PID 4436 wrote to memory of 1048	4436	cmd.exe	106
PID 4436 wrote to memory of 1048	4436	cmd.exe	106
PID 4436 wrote to memory of 4368	4436	cmd.exe	107
PID 4436 wrote to memory of 4368	4436	cmd.exe	107
PID 4436 wrote to memory of 3080	4436	cmd.exe	108
PID 4436 wrote to memory of 3080	4436	cmd.exe	108
PID 4436 wrote to memory of 864	4436	cmd.exe	109
PID 4436 wrote to memory of 864	4436	cmd.exe	109
PID 4436 wrote to memory of 3716	4436	cmd.exe	110
PID 4436 wrote to memory of 3716	4436	cmd.exe	110
PID 4436 wrote to memory of 2808	4436	cmd.exe	112
PID 4436 wrote to memory of 2808	4436	cmd.exe	112
PID 4436 wrote to memory of 2752	4436	cmd.exe	113
PID 4436 wrote to memory of 2752	4436	cmd.exe	113
PID 4436 wrote to memory of 3376	4436	cmd.exe	114
PID 4436 wrote to memory of 3376	4436	cmd.exe	114
PID 4436 wrote to memory of 4560	4436	cmd.exe	115
PID 4436 wrote to memory of 4560	4436	cmd.exe	115
PID 4436 wrote to memory of 5064	4436	cmd.exe	116
PID 4436 wrote to memory of 5064	4436	cmd.exe	116
PID 4436 wrote to memory of 2816	4436	cmd.exe	117
PID 4436 wrote to memory of 2816	4436	cmd.exe	117
PID 4436 wrote to memory of 5012	4436	cmd.exe	118
PID 4436 wrote to memory of 5012	4436	cmd.exe	118
PID 4436 wrote to memory of 1560	4436	cmd.exe	119
PID 4436 wrote to memory of 1560	4436	cmd.exe	119
PID 4436 wrote to memory of 2676	4436	cmd.exe	121
PID 4436 wrote to memory of 2676	4436	cmd.exe	121

Views/modifies file attributes 1 TTPs 1 IoCs

evasion

Hidden Files and Directories

T1564.001

pid	Process
1400	attrib.exe

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\close 5.bat"
1⤵
- Suspicious use of WriteProcessMemory
PID:4436
- C:\Windows\system32\mode.com
  mode con cols=200 lines=25
  2⤵
  PID:4904
- C:\Windows\system32\attrib.exe
  attrib +h "C:\Users\Admin\AppData\Local\Temp\close 5.bat"
  2⤵
  - Views/modifies file attributes
  PID:1400
- C:\Windows\system32\timeout.exe
  timeout /t 1 /nobreak
  2⤵
  - Delays execution with timeout.exe
  PID:4696
- C:\Windows\system32\timeout.exe
  timeout /t 1 /nobreak
  2⤵
  - Delays execution with timeout.exe
  PID:456
- C:\Windows\system32\timeout.exe
  timeout /t 1 /nobreak
  2⤵
  - Delays execution with timeout.exe
  PID:2576
- C:\Windows\system32\timeout.exe
  timeout /t 1 /nobreak
  2⤵
  - Delays execution with timeout.exe
  PID:5100
- C:\Windows\system32\timeout.exe
  timeout /t 1 /nobreak
  2⤵
  - Delays execution with timeout.exe
  PID:3956
- C:\Windows\system32\timeout.exe
  timeout /t 1 /nobreak
  2⤵
  - Delays execution with timeout.exe
  PID:4112
- C:\Windows\system32\timeout.exe
  timeout /t 1 /nobreak
  2⤵
  - Delays execution with timeout.exe
  PID:3980
- C:\Windows\system32\timeout.exe
  timeout /t 1 /nobreak
  2⤵
  - Delays execution with timeout.exe
  PID:5032
- C:\Windows\system32\timeout.exe
  timeout /t 1 /nobreak
  2⤵
  - Delays execution with timeout.exe
  PID:2548
- C:\Windows\system32\timeout.exe
  timeout /t 1 /nobreak
  2⤵
  - Delays execution with timeout.exe
  PID:1048
- C:\Windows\system32\timeout.exe
  timeout /t 1 /nobreak
  2⤵
  - Delays execution with timeout.exe
  PID:4368
- C:\Windows\system32\timeout.exe
  timeout /t 1 /nobreak
  2⤵
  - Delays execution with timeout.exe
  PID:3080
- C:\Windows\system32\timeout.exe
  timeout /t 1 /nobreak
  2⤵
  - Delays execution with timeout.exe
  PID:864
- C:\Windows\system32\timeout.exe
  timeout /t 1 /nobreak
  2⤵
  - Delays execution with timeout.exe
  PID:3716
- C:\Windows\system32\timeout.exe
  timeout /t 1 /nobreak
  2⤵
  - Delays execution with timeout.exe
  PID:2808
- C:\Windows\system32\timeout.exe
  timeout /t 1 /nobreak
  2⤵
  - Delays execution with timeout.exe
  PID:2752
- C:\Windows\system32\timeout.exe
  timeout /t 1 /nobreak
  2⤵
  - Delays execution with timeout.exe
  PID:3376
- C:\Windows\system32\timeout.exe
  timeout /t 1 /nobreak
  2⤵
  - Delays execution with timeout.exe
  PID:4560
- C:\Windows\system32\timeout.exe
  timeout /t 1 /nobreak
  2⤵
  - Delays execution with timeout.exe
  PID:5064
- C:\Windows\system32\timeout.exe
  timeout /t 1 /nobreak
  2⤵
  - Delays execution with timeout.exe
  PID:2816
- C:\Windows\system32\timeout.exe
  timeout /t 1 /nobreak
  2⤵
  - Delays execution with timeout.exe
  PID:5012
- C:\Windows\system32\timeout.exe
  timeout /t 1 /nobreak
  2⤵
  - Delays execution with timeout.exe
  PID:1560
- C:\Windows\system32\timeout.exe
  timeout /t 1 /nobreak
  2⤵
  - Delays execution with timeout.exe
  PID:2676

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Hide Artifacts

T1564

Hidden Files and Directories

T1564.001

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Windows 7 deprecation

Loading Replay Monitor...