74b4559c637cf9529fb1750febefc4cf749590e35d80e5597abb4108ce17defc | Triage

Analysis

max time kernel
189s
max time network
234s
platform
windows10-2004_x64
resource
win10v2004-20230915-en
resource tags

arch:x64arch:x86image:win10v2004-20230915-enlocale:en-usos:windows10-2004-x64system
submitted
11/10/2023, 17:30

Sharing

Report Analysis Logs

General

Target

WinAct.bat
Size

962KB
MD5

447fdb6b0c68a313835ae10ac971e64e
SHA1

a86ef27cd19c4461d2a17af16f37ba56527c3a78
SHA256

74b4559c637cf9529fb1750febefc4cf749590e35d80e5597abb4108ce17defc
SHA512

518d12d8bfed84e22e7636075bdf541aa8677f007dd44b2d95b6e5bce47a1cda69f17471f122e69b3b99187d485650071d0e45bc3d67c612cb37c92d62177a9e
SSDEEP

24576:3rNsC+RI1JMxKVE0GNy6Wy8TaYOByZTWA:3ay1I0JxlXsyZ6A

Score

1^/10

Malware Config

Signatures

Suspicious use of WriteProcessMemory 2 IoCs

description	pid	Process	procid_target
PID 2384 wrote to memory of 4156	2384	cmd.exe	88
PID 2384 wrote to memory of 4156	2384	cmd.exe	88

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\WinAct.bat"
1⤵
- Suspicious use of WriteProcessMemory
PID:2384
- C:\Windows\system32\reg.exe
  reg query HKU\S-1-5-19
  2⤵
  PID:4156

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads