d5ab54c78f95d027c2ac14879fe9d044b0524a7bcc2a1c59122ee5b67cba379a

Analysis

max time kernel
142s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20231023-en
resource tags

arch:x64arch:x86image:win10v2004-20231023-enlocale:en-usos:windows10-2004-x64system
submitted
07-11-2023 13:51

Target

Gccg/Install MTG Cards.bat
Size

97B
MD5

6fdcff22d464860d76bcbf91c6ea552d
SHA1

e762d26a74d75cf02f3e8fc02ea63634099255b4
SHA256

26dd98120cc3806dbe24a22db74a166f801023325e9b028c9e84119dd7ec6a22
SHA512

cd7fc565d8ea400cbbe74e00e5fc55ce71767501b9b65dfd12e5af3d34ae3d44476b5a516e21b78a5887a1bee3f34289ef3e2eb6b71cfa78482d3f23417c968e

Score

7^/10

upx

UPX packed file 7 IoCs

Detects executables packed with UPX/modified UPX open source packer.

resource	yara_rule
behavioral16/memory/2068-0-0x0000000000400000-0x000000000049C000-memory.dmp	upx
behavioral16/memory/2068-1-0x0000000000400000-0x000000000049C000-memory.dmp	upx
behavioral16/memory/2744-2-0x0000000000400000-0x000000000049C000-memory.dmp	upx
behavioral16/memory/2744-3-0x0000000000400000-0x000000000049C000-memory.dmp	upx
behavioral16/memory/4416-4-0x0000000000400000-0x000000000049C000-memory.dmp	upx
behavioral16/memory/2112-5-0x0000000000400000-0x000000000049C000-memory.dmp	upx
behavioral16/memory/2568-6-0x0000000000400000-0x000000000049C000-memory.dmp	upx

Suspicious behavior: EnumeratesProcesses 10 IoCs

Suspicious use of WriteProcessMemory 18 IoCs

description	pid	Process	procid_target
PID 3788 wrote to memory of 3464	3788	cmd.exe	87
PID 3788 wrote to memory of 3464	3788	cmd.exe	87
PID 3788 wrote to memory of 3464	3788	cmd.exe	87
PID 3464 wrote to memory of 2068	3464	perl.exe	88
PID 3464 wrote to memory of 2068	3464	perl.exe	88
PID 3464 wrote to memory of 2068	3464	perl.exe	88
PID 3464 wrote to memory of 2744	3464	perl.exe	89
PID 3464 wrote to memory of 2744	3464	perl.exe	89
PID 3464 wrote to memory of 2744	3464	perl.exe	89
PID 3464 wrote to memory of 4416	3464	perl.exe	90
PID 3464 wrote to memory of 4416	3464	perl.exe	90
PID 3464 wrote to memory of 4416	3464	perl.exe	90
PID 3464 wrote to memory of 2112	3464	perl.exe	92
PID 3464 wrote to memory of 2112	3464	perl.exe	92
PID 3464 wrote to memory of 2112	3464	perl.exe	92
PID 3464 wrote to memory of 2568	3464	perl.exe	94
PID 3464 wrote to memory of 2568	3464	perl.exe	94
PID 3464 wrote to memory of 2568	3464	perl.exe	94

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\Gccg\Install MTG Cards.bat"
1⤵
- Suspicious use of WriteProcessMemory
PID:3788
- C:\Users\Admin\AppData\Local\Temp\Gccg\perl.exe
  perl gccg_package install core client fonts-windows windows32 mtg mtg-cards-*
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:3464
- - C:\Users\Admin\AppData\Local\Temp\Gccg\wget.exe
    wget -t 0 http://gccg.sourceforge.net/modules/available.xml
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:2068
- - C:\Users\Admin\AppData\Local\Temp\Gccg\wget.exe
    wget -t 0 http://www.derangedmonkey.com/bmin/available.xml
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:2744
- - C:\Users\Admin\AppData\Local\Temp\Gccg\wget.exe
    wget -t 0 http://www.reneploetz.de/gccg/available.xml
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:4416
- - C:\Users\Admin\AppData\Local\Temp\Gccg\wget.exe
    wget -t 0 http://lotrtcgdb.com/files/gccg/available.xml
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:2112
- - C:\Users\Admin\AppData\Local\Temp\Gccg\wget.exe
    wget -t 0 http://whiterose.net/~wlk/gccg/available.xml
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:2568

memory/2068-0-0x0000000000400000-0x000000000049C000-memory.dmp

Filesize
624KB

Download
memory/2068-1-0x0000000000400000-0x000000000049C000-memory.dmp

Filesize
624KB

Download
memory/2112-5-0x0000000000400000-0x000000000049C000-memory.dmp

Filesize
624KB

Download
memory/2568-6-0x0000000000400000-0x000000000049C000-memory.dmp

Filesize
624KB

Download
memory/2744-2-0x0000000000400000-0x000000000049C000-memory.dmp

Filesize
624KB

Download
memory/2744-3-0x0000000000400000-0x000000000049C000-memory.dmp

Filesize
624KB

Download
memory/4416-4-0x0000000000400000-0x000000000049C000-memory.dmp

Filesize
624KB

Download