Resubmissions

02/11/2023, 15:01

231102-sdwxkafe89 7

02/11/2023, 14:58

231102-scexnade9x 7

Analysis

  • max time kernel
    117s
  • max time network
    128s
  • platform
    windows7_x64
  • resource
    win7-20231020-en
  • resource tags

    arch:x64arch:x86image:win7-20231020-enlocale:en-usos:windows7-x64system
  • submitted
    02/11/2023, 14:58

General

  • Target

    EzExploit/launch-standard.bat

  • Size

    45B

  • MD5

    94c75b944240c0176898696f27116665

  • SHA1

    a50fe41985615ab67d65f00cb51deef76715def9

  • SHA256

    874f32053f82fcc17168d294d239fedf256958cc9ca90176153a8eb62886b4be

  • SHA512

    e6f6c83870c228bcd6f42af05c0e7cc29c9b79095ccbbf63719d3b700191809e1d5741958c56d0d6f5e0adc5d9cc34f00d9f2a0c71516330fbe6f2aa32a70aa4

Score
1/10

Malware Config

Signatures

  • Suspicious use of WriteProcessMemory 3 IoCs

Processes

  • C:\Windows\system32\cmd.exe
    cmd /c "C:\Users\Admin\AppData\Local\Temp\EzExploit\launch-standard.bat"
    1⤵
    • Suspicious use of WriteProcessMemory
    PID:1196
    • C:\Windows\system32\java.exe
      java -jar ezexploit_standard.jar
      2⤵
        PID:3052
    • C:\Windows\explorer.exe
      "C:\Windows\explorer.exe"
      1⤵
        PID:2736

      Network

      MITRE ATT&CK Matrix

      Replay Monitor

      Loading Replay Monitor...

      Downloads

      • memory/3052-10-0x0000000000320000-0x0000000000321000-memory.dmp

        Filesize

        4KB

      • memory/3052-9-0x0000000002170000-0x0000000005170000-memory.dmp

        Filesize

        48.0MB