d5ab54c78f95d027c2ac14879fe9d044b0524a7bcc2a1c59122ee5b67cba379a

Analysis

max time kernel
121s
max time network
126s
platform
windows7_x64
resource
win7-20231020-en
resource tags

arch:x64arch:x86image:win7-20231020-enlocale:en-usos:windows7-x64system
submitted
07/11/2023, 13:51

Target

Gccg/Install Pokemon.bat
Size

93B
MD5

ff1be5e50f6f0d3e217ede89d1f8dcf3
SHA1

baebc13b2e7be0f18ce5162836526914cc5dd252
SHA256

c71674818558f0f57fbc610ae2e9c703cbe2e00a31d4e18a1713806c42cd7cc2
SHA512

127917837d5d7a67967044e89d818e87da65115eb0080241fc01687c00fb60ffd3f8a95b3ec8334168d116d896a920542461e298d49213487643ad4ab7aeb8ad

Score

7^/10

upx

UPX packed file 10 IoCs

Detects executables packed with UPX/modified UPX open source packer.

resource	yara_rule
behavioral21/memory/2628-0-0x0000000000170000-0x000000000020C000-memory.dmp	upx
behavioral21/memory/2892-2-0x0000000000400000-0x000000000049C000-memory.dmp	upx
behavioral21/memory/2892-3-0x0000000000400000-0x000000000049C000-memory.dmp	upx
behavioral21/memory/2892-5-0x0000000000400000-0x000000000049C000-memory.dmp	upx
behavioral21/memory/2692-6-0x0000000000400000-0x000000000049C000-memory.dmp	upx
behavioral21/memory/2812-8-0x0000000000400000-0x000000000049C000-memory.dmp	upx
behavioral21/memory/2700-10-0x0000000000400000-0x000000000049C000-memory.dmp	upx
behavioral21/memory/2700-13-0x0000000000400000-0x000000000049C000-memory.dmp	upx
behavioral21/memory/2588-14-0x0000000000400000-0x000000000049C000-memory.dmp	upx
behavioral21/memory/2588-16-0x0000000000400000-0x000000000049C000-memory.dmp	upx

Suspicious behavior: CmdExeWriteProcessMemorySpam 1 IoCs

pid	Process
2628	perl.exe

Suspicious behavior: EnumeratesProcesses 5 IoCs

Suspicious use of WriteProcessMemory 24 IoCs

description	pid	Process	procid_target
PID 2176 wrote to memory of 2628	2176	cmd.exe	29
PID 2176 wrote to memory of 2628	2176	cmd.exe	29
PID 2176 wrote to memory of 2628	2176	cmd.exe	29
PID 2176 wrote to memory of 2628	2176	cmd.exe	29
PID 2628 wrote to memory of 2892	2628	perl.exe	30
PID 2628 wrote to memory of 2892	2628	perl.exe	30
PID 2628 wrote to memory of 2892	2628	perl.exe	30
PID 2628 wrote to memory of 2892	2628	perl.exe	30
PID 2628 wrote to memory of 2692	2628	perl.exe	31
PID 2628 wrote to memory of 2692	2628	perl.exe	31
PID 2628 wrote to memory of 2692	2628	perl.exe	31
PID 2628 wrote to memory of 2692	2628	perl.exe	31
PID 2628 wrote to memory of 2812	2628	perl.exe	32
PID 2628 wrote to memory of 2812	2628	perl.exe	32
PID 2628 wrote to memory of 2812	2628	perl.exe	32
PID 2628 wrote to memory of 2812	2628	perl.exe	32
PID 2628 wrote to memory of 2700	2628	perl.exe	33
PID 2628 wrote to memory of 2700	2628	perl.exe	33
PID 2628 wrote to memory of 2700	2628	perl.exe	33
PID 2628 wrote to memory of 2700	2628	perl.exe	33
PID 2628 wrote to memory of 2588	2628	perl.exe	36
PID 2628 wrote to memory of 2588	2628	perl.exe	36
PID 2628 wrote to memory of 2588	2628	perl.exe	36
PID 2628 wrote to memory of 2588	2628	perl.exe	36

C:\Windows\system32\cmd.exe
cmd /c "C:\Users\Admin\AppData\Local\Temp\Gccg\Install Pokemon.bat"
1⤵
- Suspicious use of WriteProcessMemory
PID:2176
- C:\Users\Admin\AppData\Local\Temp\Gccg\perl.exe
  perl gccg_package install core client fonts-windows windows32 pokemon
  2⤵
  - Suspicious behavior: CmdExeWriteProcessMemorySpam
  - Suspicious use of WriteProcessMemory
  PID:2628
- - C:\Users\Admin\AppData\Local\Temp\Gccg\wget.exe
    wget -t 0 http://gccg.sourceforge.net/modules/available.xml
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:2892
- - C:\Users\Admin\AppData\Local\Temp\Gccg\wget.exe
    wget -t 0 http://www.derangedmonkey.com/bmin/available.xml
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:2692
- - C:\Users\Admin\AppData\Local\Temp\Gccg\wget.exe
    wget -t 0 http://www.reneploetz.de/gccg/available.xml
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:2812
- - C:\Users\Admin\AppData\Local\Temp\Gccg\wget.exe
    wget -t 0 http://lotrtcgdb.com/files/gccg/available.xml
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:2700
- - C:\Users\Admin\AppData\Local\Temp\Gccg\wget.exe
    wget -t 0 http://whiterose.net/~wlk/gccg/available.xml
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:2588

memory/2588-16-0x0000000000400000-0x000000000049C000-memory.dmp

Filesize
624KB

Download
memory/2588-14-0x0000000000400000-0x000000000049C000-memory.dmp

Filesize
624KB

Download
memory/2628-1-0x0000000000170000-0x000000000020C000-memory.dmp

Filesize
624KB

Download
memory/2628-0-0x0000000000170000-0x000000000020C000-memory.dmp

Filesize
624KB

Download
memory/2692-6-0x0000000000400000-0x000000000049C000-memory.dmp

Filesize
624KB

Download
memory/2700-10-0x0000000000400000-0x000000000049C000-memory.dmp

Filesize
624KB

Download
memory/2700-13-0x0000000000400000-0x000000000049C000-memory.dmp

Filesize
624KB

Download
memory/2812-8-0x0000000000400000-0x000000000049C000-memory.dmp

Filesize
624KB

Download
memory/2892-5-0x0000000000400000-0x000000000049C000-memory.dmp

Filesize
624KB

Download
memory/2892-3-0x0000000000400000-0x000000000049C000-memory.dmp

Filesize
624KB

Download
memory/2892-2-0x0000000000400000-0x000000000049C000-memory.dmp

Filesize
624KB

Download