9e4330c26a27910b5713211ae3bf5a93c20e00bedb60c0f63e773cebd48ec9c6 | Triage

Analysis

max time kernel
120s
max time network
121s
platform
windows7_x64
resource
win7-20231129-en
resource tags

arch:x64arch:x86image:win7-20231129-enlocale:en-usos:windows7-x64system
submitted
18/01/2024, 06:40

Sharing

Report Analysis Logs

General

Target

免费版/NiniUnreg.bat
Size

23B
MD5

8725ea97b1b0dd322185678485c33cce
SHA1

9d918af87b24a5869a6cea89be13274642e9ae34
SHA256

60c90b174c1e3f3211e576061117880f25a49410f4b48c565f6eff4562d9fea4
SHA512

70de631a93c93099d481d86fe6706014565990c40697374c253656366563775173c30bc97c6b132c095c36730453c08cd7861e671ee6c1d3a198f6fc7473bdbe

Score

1^/10

Malware Config

Signatures

Suspicious behavior: CmdExeWriteProcessMemorySpam 1 IoCs

pid	Process
2884	regsvr32.exe

Suspicious use of WriteProcessMemory 12 IoCs

description	pid	Process	procid_target
PID 804 wrote to memory of 2884	804	cmd.exe	29
PID 804 wrote to memory of 2884	804	cmd.exe	29
PID 804 wrote to memory of 2884	804	cmd.exe	29
PID 804 wrote to memory of 2884	804	cmd.exe	29
PID 804 wrote to memory of 2884	804	cmd.exe	29
PID 2884 wrote to memory of 3004	2884	regsvr32.exe	30
PID 2884 wrote to memory of 3004	2884	regsvr32.exe	30
PID 2884 wrote to memory of 3004	2884	regsvr32.exe	30
PID 2884 wrote to memory of 3004	2884	regsvr32.exe	30
PID 2884 wrote to memory of 3004	2884	regsvr32.exe	30
PID 2884 wrote to memory of 3004	2884	regsvr32.exe	30
PID 2884 wrote to memory of 3004	2884	regsvr32.exe	30

C:\Windows\system32\cmd.exe
cmd /c "C:\Users\Admin\AppData\Local\Temp\免费版\NiniUnreg.bat"
1⤵
- Suspicious use of WriteProcessMemory
PID:804
- C:\Windows\system32\regsvr32.exe
  regsvr32 /u ninicom.dll
  2⤵
  - Suspicious behavior: CmdExeWriteProcessMemorySpam
  - Suspicious use of WriteProcessMemory
  PID:2884
- - C:\Windows\SysWOW64\regsvr32.exe
    /u ninicom.dll
    3⤵
    PID:3004

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads