d5ab54c78f95d027c2ac14879fe9d044b0524a7bcc2a1c59122ee5b67cba379a

Analysis

max time kernel
109s
max time network
173s
platform
windows10-2004_x64
resource
win10v2004-20231023-en
resource tags

arch:x64arch:x86image:win10v2004-20231023-enlocale:en-usos:windows10-2004-x64system
submitted
07/11/2023, 13:51

Target

Gccg/Install LOTR Cards.bat
Size

106B
MD5

fc944f16ad070819e5f954d718ccbfc9
SHA1

6b8de8dad482a83850317290b08e7962561f3de4
SHA256

f7a9445304f7062190334498f972bc217855deb8510e14f320a1a0db3e2decc9
SHA512

39b24d838214e0c8a3896b652c9afa5c58729c7bad5f8a3207e44d18dc8198505ae44fd79d4e7bb2030c40b8d42b255f4a2eeb794f08bc845ada94c830e1dd4c

Score

7^/10

upx

UPX packed file 6 IoCs

Detects executables packed with UPX/modified UPX open source packer.

resource	yara_rule
behavioral4/memory/4816-0-0x0000000000400000-0x000000000049C000-memory.dmp	upx
behavioral4/memory/4816-1-0x0000000000400000-0x000000000049C000-memory.dmp	upx
behavioral4/memory/2412-2-0x0000000000400000-0x000000000049C000-memory.dmp	upx
behavioral4/memory/776-3-0x0000000000400000-0x000000000049C000-memory.dmp	upx
behavioral4/memory/4552-4-0x0000000000400000-0x000000000049C000-memory.dmp	upx
behavioral4/memory/2148-5-0x0000000000400000-0x000000000049C000-memory.dmp	upx

Suspicious behavior: EnumeratesProcesses 10 IoCs

Suspicious use of WriteProcessMemory 18 IoCs

description	pid	Process	procid_target
PID 1984 wrote to memory of 1012	1984	cmd.exe	87
PID 1984 wrote to memory of 1012	1984	cmd.exe	87
PID 1984 wrote to memory of 1012	1984	cmd.exe	87
PID 1012 wrote to memory of 4816	1012	perl.exe	89
PID 1012 wrote to memory of 4816	1012	perl.exe	89
PID 1012 wrote to memory of 4816	1012	perl.exe	89
PID 1012 wrote to memory of 2412	1012	perl.exe	91
PID 1012 wrote to memory of 2412	1012	perl.exe	91
PID 1012 wrote to memory of 2412	1012	perl.exe	91
PID 1012 wrote to memory of 776	1012	perl.exe	92
PID 1012 wrote to memory of 776	1012	perl.exe	92
PID 1012 wrote to memory of 776	1012	perl.exe	92
PID 1012 wrote to memory of 4552	1012	perl.exe	94
PID 1012 wrote to memory of 4552	1012	perl.exe	94
PID 1012 wrote to memory of 4552	1012	perl.exe	94
PID 1012 wrote to memory of 2148	1012	perl.exe	95
PID 1012 wrote to memory of 2148	1012	perl.exe	95
PID 1012 wrote to memory of 2148	1012	perl.exe	95

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\Gccg\Install LOTR Cards.bat"
1⤵
- Suspicious use of WriteProcessMemory
PID:1984
- C:\Users\Admin\AppData\Local\Temp\Gccg\perl.exe
  perl gccg_package install core client fonts fonts-windows windows32 lotr lotr-cards-*
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1012
- - C:\Users\Admin\AppData\Local\Temp\Gccg\wget.exe
    wget -t 0 http://gccg.sourceforge.net/modules/available.xml
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:4816
- - C:\Users\Admin\AppData\Local\Temp\Gccg\wget.exe
    wget -t 0 http://www.derangedmonkey.com/bmin/available.xml
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:2412
- - C:\Users\Admin\AppData\Local\Temp\Gccg\wget.exe
    wget -t 0 http://www.reneploetz.de/gccg/available.xml
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:776
- - C:\Users\Admin\AppData\Local\Temp\Gccg\wget.exe
    wget -t 0 http://lotrtcgdb.com/files/gccg/available.xml
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:4552
- - C:\Users\Admin\AppData\Local\Temp\Gccg\wget.exe
    wget -t 0 http://whiterose.net/~wlk/gccg/available.xml
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:2148

memory/776-3-0x0000000000400000-0x000000000049C000-memory.dmp

Filesize
624KB

Download
memory/2148-5-0x0000000000400000-0x000000000049C000-memory.dmp

Filesize
624KB

Download
memory/2412-2-0x0000000000400000-0x000000000049C000-memory.dmp

Filesize
624KB

Download
memory/4552-4-0x0000000000400000-0x000000000049C000-memory.dmp

Filesize
624KB

Download
memory/4816-0-0x0000000000400000-0x000000000049C000-memory.dmp

Filesize
624KB

Download
memory/4816-1-0x0000000000400000-0x000000000049C000-memory.dmp

Filesize
624KB

Download