d5ab54c78f95d027c2ac14879fe9d044b0524a7bcc2a1c59122ee5b67cba379a

Analysis

max time kernel
142s
max time network
154s
platform
windows10-2004_x64
resource
win10v2004-20231020-en
resource tags

arch:x64arch:x86image:win10v2004-20231020-enlocale:en-usos:windows10-2004-x64system
submitted
07/11/2023, 13:51

Target

Gccg/Install METW.bat
Size

87B
MD5

8b327492afdc3a52fa3130e56a139280
SHA1

83b875bdd5e7d370e5541366de278b29d52adb80
SHA256

7b409ba32a2aa9cb55c6d32455a2a390f23dcf8ce09fea478d3abb2b05615b28
SHA512

c5940a3256090ef306b2372214ef2ee5a79c76ca8da211c2b78679318942d0cd65b4f4f64adede27621c2a9f56143803c9dc6b3abd7ad60a1cff5431be4f0a07

Score

7^/10

upx

UPX packed file 7 IoCs

Detects executables packed with UPX/modified UPX open source packer.

resource	yara_rule
behavioral14/memory/904-0-0x0000000000400000-0x000000000049C000-memory.dmp	upx
behavioral14/memory/904-1-0x0000000000400000-0x000000000049C000-memory.dmp	upx
behavioral14/memory/2376-2-0x0000000000400000-0x000000000049C000-memory.dmp	upx
behavioral14/memory/1660-3-0x0000000000400000-0x000000000049C000-memory.dmp	upx
behavioral14/memory/64-4-0x0000000000400000-0x000000000049C000-memory.dmp	upx
behavioral14/memory/64-5-0x0000000000400000-0x000000000049C000-memory.dmp	upx
behavioral14/memory/4804-6-0x0000000000400000-0x000000000049C000-memory.dmp	upx

Suspicious behavior: EnumeratesProcesses 10 IoCs

Suspicious use of WriteProcessMemory 18 IoCs

description	pid	Process	procid_target
PID 3572 wrote to memory of 4904	3572	cmd.exe	87
PID 3572 wrote to memory of 4904	3572	cmd.exe	87
PID 3572 wrote to memory of 4904	3572	cmd.exe	87
PID 4904 wrote to memory of 904	4904	perl.exe	88
PID 4904 wrote to memory of 904	4904	perl.exe	88
PID 4904 wrote to memory of 904	4904	perl.exe	88
PID 4904 wrote to memory of 2376	4904	perl.exe	89
PID 4904 wrote to memory of 2376	4904	perl.exe	89
PID 4904 wrote to memory of 2376	4904	perl.exe	89
PID 4904 wrote to memory of 1660	4904	perl.exe	90
PID 4904 wrote to memory of 1660	4904	perl.exe	90
PID 4904 wrote to memory of 1660	4904	perl.exe	90
PID 4904 wrote to memory of 64	4904	perl.exe	92
PID 4904 wrote to memory of 64	4904	perl.exe	92
PID 4904 wrote to memory of 64	4904	perl.exe	92
PID 4904 wrote to memory of 4804	4904	perl.exe	93
PID 4904 wrote to memory of 4804	4904	perl.exe	93
PID 4904 wrote to memory of 4804	4904	perl.exe	93

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\Gccg\Install METW.bat"
1⤵
- Suspicious use of WriteProcessMemory
PID:3572
- C:\Users\Admin\AppData\Local\Temp\Gccg\perl.exe
  perl gccg_package install core client fonts-windows windows32 metw
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:4904
- - C:\Users\Admin\AppData\Local\Temp\Gccg\wget.exe
    wget -t 0 http://gccg.sourceforge.net/modules/available.xml
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:904
- - C:\Users\Admin\AppData\Local\Temp\Gccg\wget.exe
    wget -t 0 http://www.derangedmonkey.com/bmin/available.xml
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:2376
- - C:\Users\Admin\AppData\Local\Temp\Gccg\wget.exe
    wget -t 0 http://www.reneploetz.de/gccg/available.xml
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:1660
- - C:\Users\Admin\AppData\Local\Temp\Gccg\wget.exe
    wget -t 0 http://lotrtcgdb.com/files/gccg/available.xml
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:64
- - C:\Users\Admin\AppData\Local\Temp\Gccg\wget.exe
    wget -t 0 http://whiterose.net/~wlk/gccg/available.xml
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:4804

memory/64-4-0x0000000000400000-0x000000000049C000-memory.dmp

Filesize
624KB

Download
memory/64-5-0x0000000000400000-0x000000000049C000-memory.dmp

Filesize
624KB

Download
memory/904-0-0x0000000000400000-0x000000000049C000-memory.dmp

Filesize
624KB

Download
memory/904-1-0x0000000000400000-0x000000000049C000-memory.dmp

Filesize
624KB

Download
memory/1660-3-0x0000000000400000-0x000000000049C000-memory.dmp

Filesize
624KB

Download
memory/2376-2-0x0000000000400000-0x000000000049C000-memory.dmp

Filesize
624KB

Download
memory/4804-6-0x0000000000400000-0x000000000049C000-memory.dmp

Filesize
624KB

Download