1280f1231821c54593cf68cfff6a3d73c9cbf61512df9c4ad17926c6936e43cc

Analysis

max time kernel
139s
max time network
158s
platform
windows10-2004_x64
resource
win10v2004-20230915-en
resource tags

arch:x64arch:x86image:win10v2004-20230915-enlocale:en-usos:windows10-2004-x64system
submitted
13/10/2023, 04:32

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

Load Driver [ADMIN].bat
Size

38B
MD5

b56b9ab3209f7b0958976644f03776f8
SHA1

054c58ab6b517710776fa6ed8e20aabaf37d360f
SHA256

419124eb528c4c9ddb1e3713b72be124437f5632cf0ad1cbdc5b81c52407c401
SHA512

bf2515e032f3dd8885b4e8aead91dce3d46199d3dad242b8fee980b33a99def11def0f64936da7f3d456d4d376f0c3df68a4dca04b50f9cd314e99441a3d9f77

Score

8^/10

persistence

Malware Config

Signatures

Sets service image path in registry 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\cNEEprgENsKeofnjtjNkpxiyEd\ImagePath = "\\??\\C:\\Users\\Admin\\AppData\\Local\\Temp\\cNEEprgENsKeofnjtjNkpxiyEd"	Mapper.exe

Suspicious behavior: LoadsDriver 1 IoCs

pid	Process
2192	Mapper.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeLoadDriverPrivilege	2192	Mapper.exe

Suspicious use of WriteProcessMemory 2 IoCs

description	pid	Process	procid_target
PID 4528 wrote to memory of 2192	4528	cmd.exe	82
PID 4528 wrote to memory of 2192	4528	cmd.exe	82

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\Load Driver [ADMIN].bat"
1⤵
- Suspicious use of WriteProcessMemory
PID:4528
- C:\Users\Admin\AppData\Local\Temp\Mapper.exe
  Mapper.exe Kernel.sys
  2⤵
  - Sets service image path in registry
  - Suspicious behavior: LoadsDriver
  - Suspicious use of AdjustPrivilegeToken
  PID:2192

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads