fc6d3cd59588db62afcd01140526c1b6ce6a5bf801079da62d228371457ad93f

Analysis

max time kernel
117s
max time network
118s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
03/01/2024, 14:16

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

EV去除录屏检测工具v2.81/EV去除录屏检测工具v2.81/关闭系统杀毒.bat
Size

1KB
MD5

7901cb31a047e5882333715d239c6891
SHA1

3ca110edeefef8ff25deff6f7107208d5b5fb216
SHA256

32906fd9d02aa0bbaa29f45351f189d2581f1c843a5ded22e9e3b11eb18a6ff2
SHA512

7f23d20fe6067b502dc742c5b609b327583d17fa1c3497a820f9f49670240b98e26281d4209794013bf47aaffd7c67c5bf1527af9ddb25ac6db43bf6eb5b3bcc

Score

3^/10

Malware Config

Signatures

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Modifies Internet Explorer settings 1 TTPs 1 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\Main	mshta.exe

Suspicious behavior: CmdExeWriteProcessMemorySpam 1 IoCs

pid	Process
1828	mshta.exe

Suspicious use of WriteProcessMemory 12 IoCs

description	pid	Process	procid_target
PID 2108 wrote to memory of 1828	2108	cmd.exe	29
PID 2108 wrote to memory of 1828	2108	cmd.exe	29
PID 2108 wrote to memory of 1828	2108	cmd.exe	29
PID 2108 wrote to memory of 1828	2108	cmd.exe	29
PID 1828 wrote to memory of 2044	1828	mshta.exe	30
PID 1828 wrote to memory of 2044	1828	mshta.exe	30
PID 1828 wrote to memory of 2044	1828	mshta.exe	30
PID 1828 wrote to memory of 2044	1828	mshta.exe	30
PID 2044 wrote to memory of 1676	2044	cmd.exe	32
PID 2044 wrote to memory of 1676	2044	cmd.exe	32
PID 2044 wrote to memory of 1676	2044	cmd.exe	32
PID 2044 wrote to memory of 1676	2044	cmd.exe	32

C:\Windows\system32\cmd.exe
cmd /c "C:\Users\Admin\AppData\Local\Temp\EV去除录屏检测工具v2.81\EV去除录屏检测工具v2.81\关闭系统杀毒.bat"
1⤵
- Suspicious use of WriteProcessMemory
PID:2108
- C:\Windows\SysWOW64\mshta.exe
  C:\Windows\SysWOW64\mshta.exe vbscript:CreateObject("Shell.Application").ShellExecute("cmd.exe","/c C:\Users\Admin\AppData\Local\Temp\EVV2~1.81\EVV2~1.81\2873~1.BAT ::","","runas",1)(window.close)
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious behavior: CmdExeWriteProcessMemorySpam
  - Suspicious use of WriteProcessMemory
  PID:1828
- - C:\Windows\SysWOW64\cmd.exe
    "C:\Windows\System32\cmd.exe" /c C:\Users\Admin\AppData\Local\Temp\EVV2~1.81\EVV2~1.81\2873~1.BAT ::
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:2044
  - - C:\Windows\SysWOW64\choice.exe
      choice /c 12 /n /m "╟δ╩Σ╚δ╤í╧εú¿1╗≥2ú⌐ú║"
      4⤵
      PID:1676

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads