518c5a69231dc87391896be44c5f7c9d36ec375d4c2878b6783869cce8da1133 | Triage

Analysis

max time kernel
142s
max time network
122s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
22/12/2023, 13:02

Sharing

Report Analysis Logs

General

Target

SuperOneClickv1.5.5/SuperOneClickv1.5.5/2.安装visionary+.bat
Size

27B
MD5

eb3d2fa2f4292efd8d0f27af9f72e74f
SHA1

40512bf2961cd3c35e749956e18ee2a87ca5a118
SHA256

5e23d176e10bcd4aa429a5eabf01be10c53e038869320058716685aa46ecf836
SHA512

d82829d403ef4a76f43e7e077941c4cdf61ebd52f1d457489b6aae96b3d2e89dfded213de4bd327310a6aa2d31fcb253b63ed7fc8eecb6f88e5eb096ec1e9c2e

Score

1^/10

Malware Config

Signatures

Suspicious behavior: CmdExeWriteProcessMemorySpam 1 IoCs

pid	Process
1176	adb.exe

Suspicious use of WriteProcessMemory 8 IoCs

description	pid	Process	procid_target
PID 1716 wrote to memory of 1176	1716	cmd.exe	16
PID 1716 wrote to memory of 1176	1716	cmd.exe	16
PID 1716 wrote to memory of 1176	1716	cmd.exe	16
PID 1716 wrote to memory of 1176	1716	cmd.exe	16
PID 1176 wrote to memory of 2360	1176	adb.exe	30
PID 1176 wrote to memory of 2360	1176	adb.exe	30
PID 1176 wrote to memory of 2360	1176	adb.exe	30
PID 1176 wrote to memory of 2360	1176	adb.exe	30

C:\Users\Admin\AppData\Local\Temp\SuperOneClickv1.5.5\SuperOneClickv1.5.5\adb.exe
adb install root.apk
1⤵
- Suspicious behavior: CmdExeWriteProcessMemorySpam
- Suspicious use of WriteProcessMemory
PID:1176
- C:\Users\Admin\AppData\Local\Temp\SuperOneClickv1.5.5\SuperOneClickv1.5.5\adb.exe
  adb fork-server server
  2⤵
  PID:2360

C:\Windows\system32\cmd.exe
cmd /c "C:\Users\Admin\AppData\Local\Temp\SuperOneClickv1.5.5\SuperOneClickv1.5.5\2.安装visionary+.bat"
1⤵
- Suspicious use of WriteProcessMemory
PID:1716

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads