33af3e0f5884bfae36bf081b9eb0ca696c9d3620e74255f72ef1291983e49213

Analysis

max time kernel
149s
max time network
137s
platform
windows10-2004_x64
resource
win10v2004-20231215-en
resource tags

arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
submitted
24/12/2023, 17:54

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

copy.cmd
Size

1KB
MD5

505cb6fccd0e15d878b8dcbac64ad4d5
SHA1

9b49f5035dd7855646d94bd38cb500805f7829e4
SHA256

c4b7e33e97a94a80aea645e8f8601cb3db420bc5a7f828abb93054c2f69341f2
SHA512

bc5b17105fbbbaa3af7a8eb0708d379a3206eae93391939584503096a7e8eb260dacb75efe7b82d19fac4c4c2921cc9df36269977cd840c1208905ed08e7771c

Score

8^/10

evasion

Malware Config

Signatures

Sets file to hidden 1 TTPs 6 IoCs

Modifies file attributes to stop it showing in Explorer etc.

evasion

Hidden Files and Directories

T1564.001

pid	Process
2284	attrib.exe
208	attrib.exe
3964	attrib.exe
3144	attrib.exe
1504	attrib.exe
3660	attrib.exe

Drops file in Program Files directory 17 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\WinWare\winare.vbs	cmd.exe
File created	C:\Program Files\WinWare\360.cmd	cmd.exe
File created	C:\Program Files\WinWare\360SE.vbs	cmd.exe
File created	C:\Program Files\WinWare\36OSE.vbs	cmd.exe
File opened for modification	C:\Program Files\WinWare\tool.cmd	attrib.exe
File created	C:\Program Files\WinWare\winare.vbs	cmd.exe
File created	C:\Program Files\WinWare\tool.cmd	cmd.exe
File opened for modification	C:\Program Files\WinWare\tool.cmd	cmd.exe
File opened for modification	C:\Program Files\WinWare\360.cmd	cmd.exe
File created	C:\Program Files\WinWare\361.cmd	cmd.exe
File opened for modification	C:\Program Files\WinWare\361.cmd	cmd.exe
File opened for modification	C:\Program Files\WinWare\360SE.vbs	cmd.exe
File created	C:\Program Files\WinWare\Internet Exploror.lnk	cmd.exe
File opened for modification	C:\Program Files\WinWare\361.cmd	attrib.exe
File opened for modification	C:\Program Files\WinWare\36OSE.vbs	cmd.exe
File opened for modification	C:\Program Files\WinWare\Internet Exploror.lnk	cmd.exe
File opened for modification	C:\Program Files\WinWare\360.cmd	attrib.exe

Drops file in Windows directory 4 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Mail\UltraEdit\winare.vbs	cmd.exe
File created	C:\Windows\Mail\UltraEdit\is.cmd	cmd.exe
File opened for modification	C:\Windows\Mail\UltraEdit\is.cmd	cmd.exe
File created	C:\Windows\Mail\UltraEdit\winare.vbs	cmd.exe

Suspicious use of WriteProcessMemory 12 IoCs

description	pid	Process	procid_target
PID 4292 wrote to memory of 3660	4292	cmd.exe	17
PID 4292 wrote to memory of 3660	4292	cmd.exe	17
PID 4292 wrote to memory of 1504	4292	cmd.exe	23
PID 4292 wrote to memory of 1504	4292	cmd.exe	23
PID 4292 wrote to memory of 2284	4292	cmd.exe	18
PID 4292 wrote to memory of 2284	4292	cmd.exe	18
PID 4292 wrote to memory of 3144	4292	cmd.exe	22
PID 4292 wrote to memory of 3144	4292	cmd.exe	22
PID 4292 wrote to memory of 3964	4292	cmd.exe	20
PID 4292 wrote to memory of 3964	4292	cmd.exe	20
PID 4292 wrote to memory of 208	4292	cmd.exe	19
PID 4292 wrote to memory of 208	4292	cmd.exe	19

Views/modifies file attributes 1 TTPs 6 IoCs

evasion

Hidden Files and Directories

T1564.001

pid	Process
1504	attrib.exe
3660	attrib.exe
2284	attrib.exe
208	attrib.exe
3964	attrib.exe
3144	attrib.exe

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\copy.cmd"
1⤵
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious use of WriteProcessMemory
PID:4292
- C:\Windows\system32\attrib.exe
  attrib +r +h +s "C:\Program Files\WinWare\fav\fav.cmd"
  2⤵
  - Sets file to hidden
  - Views/modifies file attributes
  PID:3660
- C:\Windows\system32\attrib.exe
  attrib +r +h +s "C:\Program Files\Windows\36OSE.vbs"
  2⤵
  - Sets file to hidden
  - Views/modifies file attributes
  PID:2284
- C:\Windows\system32\attrib.exe
  attrib +r +h +s "C:\Program Files\WinWare\361.cmd"
  2⤵
  - Sets file to hidden
  - Drops file in Program Files directory
  - Views/modifies file attributes
  PID:208
- C:\Windows\system32\attrib.exe
  attrib +r +h +s "C:\Program Files\WinWare\360.cmd"
  2⤵
  - Sets file to hidden
  - Drops file in Program Files directory
  - Views/modifies file attributes
  PID:3964
- C:\Windows\system32\attrib.exe
  attrib +r +h +s "C:\Program Files\WinWare\tool.cmd"
  2⤵
  - Sets file to hidden
  - Drops file in Program Files directory
  - Views/modifies file attributes
  PID:3144
- C:\Windows\system32\attrib.exe
  attrib +r +h +s "C:\Program Files\Windows\360SE.vbs"
  2⤵
  - Sets file to hidden
  - Views/modifies file attributes
  PID:1504

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Hide Artifacts

T1564

Hidden Files and Directories

T1564.001

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Program Files\WinWare\360.cmd

Filesize
1KB

MD5
67240c407312315393794e9b65d1e8e5

SHA1
810b252670834678fdaa057b39e07985a029be7a

SHA256
0a29a7d11891968f5a4a6eb615e87a428d5e93c9a48908c7a1de7cf5a40acf22

SHA512
897bfb0b8b9ca3a315ff72b9c937aba50ddb88dd28ce3d8f156ccb01d008e566260e317364966fc3fe59a6f78017ad3924f32dd6d4b4a170550edc55b62bd3f2

Download Submit
C:\Program Files\WinWare\361.cmd

Filesize
567B

MD5
feb810eaa38eb0890ad2034d322e4c79

SHA1
a7c7ddd0bd405b949ddbffed364269d145ee78e4

SHA256
e346f4ed81e3e7974c4a9978789fc08737abc4c7318f31d747b1ad23ce5bf800

SHA512
f96b5e8129ab8fd4703a2e4bddf4245e9c4a64a8d69663f755386021cb8fd34a75bd0fa53b4579145bf50be2948d9ae5d0f4bdb556ae73b4cc85e6a2130f5ab9

Download Submit
C:\Program Files\WinWare\tool.cmd

Filesize
3KB

MD5
d7eece295819ac643894e11ec290fc16

SHA1
eaf976563ab1d54ddbb538846f21d80663c0482b

SHA256
00057dbc21e30cd983f4428934333acc1243bef2a7ae3e89ccfed37aaea35aef

SHA512
61602cd5b19a9f3d65c52ec8b393081949167496ec02420fe403e5ee63a3f59f29d367246af4a6ba3a6437ea46759315f6e1721fbd44f84878b548e61d261036

Download Submit

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads