7ae05c4164362a9072cf5c30d13f9f0ef8840aac009d976b05c7b05f2a905e07 | Triage

Analysis

max time kernel
118s
max time network
120s
platform
windows7_x64
resource
win7-20231129-en
resource tags

arch:x64arch:x86image:win7-20231129-enlocale:en-usos:windows7-x64system
submitted
22/12/2023, 12:55

Sharing

Report Analysis Logs

General

Target

u960_recovery_5.0.2.7_c4_cn/直接启动到recovery.bat
Size

472B
MD5

e341d705e68739d7b145625f2b92a3a8
SHA1

0b2e0b1dc8f03d963daca66d7f6aacd626328188
SHA256

3bb94a13f78a15798907d3cf7aafb7a8e61ecbdd109c9ce876312f6f2394865d
SHA512

43f739d79e8456b5cc71003841c46b7673eb6a531c7f94681d634a0ad9af14007e93851ad49ab3256a38f52d0b6e66c7b20a0ed5b2b71a45db47f13aa6065ed5

Score

1^/10

Malware Config

Signatures

Suspicious behavior: CmdExeWriteProcessMemorySpam 1 IoCs

pid	Process
1668	adb.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 824 wrote to memory of 1668	824	cmd.exe	14
PID 824 wrote to memory of 1668	824	cmd.exe	14
PID 824 wrote to memory of 1668	824	cmd.exe	14
PID 824 wrote to memory of 1668	824	cmd.exe	14

C:\Users\Admin\AppData\Local\Temp\u960_recovery_5.0.2.7_c4_cn\files\adb.exe
files\adb kill-server
1⤵
- Suspicious behavior: CmdExeWriteProcessMemorySpam
PID:1668

C:\Windows\system32\cmd.exe
cmd /c "C:\Users\Admin\AppData\Local\Temp\u960_recovery_5.0.2.7_c4_cn\直接启动到recovery.bat"
1⤵
- Suspicious use of WriteProcessMemory
PID:824

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1668-0-0x0000000000400000-0x000000000043D000-memory.dmp

Filesize
244KB

Download