7ae05c4164362a9072cf5c30d13f9f0ef8840aac009d976b05c7b05f2a905e07 | Triage

Analysis

max time kernel
117s
max time network
123s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
22/12/2023, 12:55

Sharing

Report Analysis Logs

General

Target

u960_recovery_5.0.2.7_c4_cn/安装recovery.bat
Size

1KB
MD5

9f692dae1af3ff3c975914696613b510
SHA1

7668f4629b7c6c32264f734be3e9fce6a79c17e1
SHA256

e2501b6c9a488485aa10720a36f4bf1e08e55c1802f0ef6dff7747b2cd94b3da
SHA512

a5afc7706d0c3b99fcd59ec017984f28afa40d2f61bf6ccc490637479733bb6a57d1cec3f01812178d42316ee2d66506b7540f9cce76db4c51274ca9206a79ae

Score

1^/10

Malware Config

Signatures

Suspicious behavior: CmdExeWriteProcessMemorySpam 1 IoCs

pid	Process
2020	adb.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2132 wrote to memory of 2020	2132	cmd.exe	29
PID 2132 wrote to memory of 2020	2132	cmd.exe	29
PID 2132 wrote to memory of 2020	2132	cmd.exe	29
PID 2132 wrote to memory of 2020	2132	cmd.exe	29

C:\Windows\system32\cmd.exe
cmd /c "C:\Users\Admin\AppData\Local\Temp\u960_recovery_5.0.2.7_c4_cn\安装recovery.bat"
1⤵
- Suspicious use of WriteProcessMemory
PID:2132
- C:\Users\Admin\AppData\Local\Temp\u960_recovery_5.0.2.7_c4_cn\files\adb.exe
  files\adb kill-server
  2⤵
  - Suspicious behavior: CmdExeWriteProcessMemorySpam
  PID:2020

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2020-0-0x0000000000400000-0x000000000043D000-memory.dmp

Filesize
244KB

Download