e9356e382ad63f26180ec43845f4d5941c4a7bb4375cb632ce82a2c4f86b445f

Analysis

max time kernel
147s
max time network
128s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
22/12/2023, 05:01

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

A390e_recovery5.0.2.6_gfpig/recoveryupdate.bat
Size

707B
MD5

7a805841b0f2d1d7f1a63d21b66bab27
SHA1

374502ee387a444de558b290f451646561c779fd
SHA256

088d9528d1eb19edc5a8f8497b176b7469019caab0f138274280bbfb83c1b02d
SHA512

7af1cac5d65e016e101ca1bc0e691da211a55dab4d9d13a65881a34508ef9a334fb493855b33fac2bd702bd536fb25e7d6d9347ec396f8b1f3d00e5b4b6358ab

Score

1^/10

Malware Config

Signatures

Suspicious behavior: CmdExeWriteProcessMemorySpam 6 IoCs

pid	Process
2752	adb.exe
2116	adb.exe
2756	adb.exe
2768	adb.exe
2788	adb.exe
2908	fastboot.exe

Suspicious use of WriteProcessMemory 28 IoCs

description	pid	Process	procid_target
PID 2432 wrote to memory of 2752	2432	cmd.exe	29
PID 2432 wrote to memory of 2752	2432	cmd.exe	29
PID 2432 wrote to memory of 2752	2432	cmd.exe	29
PID 2432 wrote to memory of 2752	2432	cmd.exe	29
PID 2752 wrote to memory of 3036	2752	adb.exe	30
PID 2752 wrote to memory of 3036	2752	adb.exe	30
PID 2752 wrote to memory of 3036	2752	adb.exe	30
PID 2752 wrote to memory of 3036	2752	adb.exe	30
PID 2432 wrote to memory of 2116	2432	cmd.exe	31
PID 2432 wrote to memory of 2116	2432	cmd.exe	31
PID 2432 wrote to memory of 2116	2432	cmd.exe	31
PID 2432 wrote to memory of 2116	2432	cmd.exe	31
PID 2432 wrote to memory of 2756	2432	cmd.exe	32
PID 2432 wrote to memory of 2756	2432	cmd.exe	32
PID 2432 wrote to memory of 2756	2432	cmd.exe	32
PID 2432 wrote to memory of 2756	2432	cmd.exe	32
PID 2432 wrote to memory of 2768	2432	cmd.exe	33
PID 2432 wrote to memory of 2768	2432	cmd.exe	33
PID 2432 wrote to memory of 2768	2432	cmd.exe	33
PID 2432 wrote to memory of 2768	2432	cmd.exe	33
PID 2432 wrote to memory of 2788	2432	cmd.exe	34
PID 2432 wrote to memory of 2788	2432	cmd.exe	34
PID 2432 wrote to memory of 2788	2432	cmd.exe	34
PID 2432 wrote to memory of 2788	2432	cmd.exe	34
PID 2432 wrote to memory of 2908	2432	cmd.exe	35
PID 2432 wrote to memory of 2908	2432	cmd.exe	35
PID 2432 wrote to memory of 2908	2432	cmd.exe	35
PID 2432 wrote to memory of 2908	2432	cmd.exe	35

C:\Windows\system32\cmd.exe
cmd /c "C:\Users\Admin\AppData\Local\Temp\A390e_recovery5.0.2.6_gfpig\recoveryupdate.bat"
1⤵
- Suspicious use of WriteProcessMemory
PID:2432
- C:\Users\Admin\AppData\Local\Temp\A390e_recovery5.0.2.6_gfpig\adb.exe
  adb install .\qixiazi_root.apk
  2⤵
  - Suspicious behavior: CmdExeWriteProcessMemorySpam
  - Suspicious use of WriteProcessMemory
  PID:2752
- - C:\Users\Admin\AppData\Local\Temp\A390e_recovery5.0.2.6_gfpig\adb.exe
    adb fork-server server
    3⤵
    PID:3036
- C:\Users\Admin\AppData\Local\Temp\A390e_recovery5.0.2.6_gfpig\adb.exe
  adb install .\CallMaster_V4.1.2.26_Android_pf145_bi800_(Build12073017).apk
  2⤵
  - Suspicious behavior: CmdExeWriteProcessMemorySpam
  PID:2116
- C:\Users\Admin\AppData\Local\Temp\A390e_recovery5.0.2.6_gfpig\adb.exe
  adb install .\kBatteryDoctor_2.9_2000290_14824_20120914_125957_40000018_40000018.apk
  2⤵
  - Suspicious behavior: CmdExeWriteProcessMemorySpam
  PID:2756
- C:\Users\Admin\AppData\Local\Temp\A390e_recovery5.0.2.6_gfpig\adb.exe
  adb install .\oupeng-1_1785_1785111_15_1.apk
  2⤵
  - Suspicious behavior: CmdExeWriteProcessMemorySpam
  PID:2768
- C:\Users\Admin\AppData\Local\Temp\A390e_recovery5.0.2.6_gfpig\adb.exe
  adb install .\tencentmobilemanager3.8.5_android_build0599.apk
  2⤵
  - Suspicious behavior: CmdExeWriteProcessMemorySpam
  PID:2788
- C:\Users\Admin\AppData\Local\Temp\A390e_recovery5.0.2.6_gfpig\fastboot.exe
  fastboot flash recovery recovery.img
  2⤵
  - Suspicious behavior: CmdExeWriteProcessMemorySpam
  PID:2908

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads