52fe4c7867042a5e60df8e2d74ac9fff51d906374ba3d7299c0ee8bc46f59529 | Triage

Analysis

max time kernel
117s
max time network
118s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
22/12/2023, 16:54

Sharing

Report Analysis Logs

General

Target

Public/install_drivers.bat
Size

1KB
MD5

4276f02b0da9d8e02caa9d5d8d816f31
SHA1

74790c549d9b626b8a11eb879bc043791fd6a79c
SHA256

39e31b7829733a5cf541104de0b626f85934c68721a6efa2f85c15fb0cf934d2
SHA512

c9542e6c68a6be54560927fda8932bf261a5bd01829ea7d99d45b7e289268a509a5160e0d425b1490a0af9b7fea2aeba34b209cb5cc6ba58cb164607df5242b9

Score

4^/10

Malware Config

Signatures

Drops file in Windows directory 1 IoCs

description	ioc	Process
File opened for modification	C:\Windows\INF\setupapi.dev.log	devcon.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 1708 wrote to memory of 2428	1708	cmd.exe	16
PID 1708 wrote to memory of 2428	1708	cmd.exe	16
PID 1708 wrote to memory of 2428	1708	cmd.exe	16

C:\Users\Admin\AppData\Local\Temp\Public\tools\x64\devcon.exe
tools\x64\devcon update drivers\android_winusb.inf "USB\VID_1949&PID_0006&REV_0216&MI_01"
1⤵
- Drops file in Windows directory
PID:2428

C:\Windows\system32\cmd.exe
cmd /c "C:\Users\Admin\AppData\Local\Temp\Public\install_drivers.bat"
1⤵
- Suspicious use of WriteProcessMemory
PID:1708

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads