0fb7388c69ef9d2d892e6edc7eff8c86ce6f6659c88d347234acaa1a382e22ba | Triage

Analysis

max time kernel
117s
max time network
119s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
14-02-2024 18:34

Sharing

Report Analysis Logs

General

Target

hey/twelfth.bat
Size

1KB
MD5

4e7c3ec7e4db2756209f5190355c3716
SHA1

183a6caaba0208f8bdfe3bf7e25f069ecddf19f5
SHA256

f2178583f6008d7ade32bb218bcd5d846859ce059875b4f603e18be57a59c7a8
SHA512

d3f3ddef38d17b9b2ac209719d6bcc83d13053abc9a97e4055f1b899fbfdba054317a5c94e2a688637b18440adb120065a89a7de5ae6b84ef7b91b8922bdd768

Score

1^/10

Malware Config

Signatures

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

cmd.exe

description	pid	process	target process
PID 1564 wrote to memory of 2232	1564	cmd.exe	xcopy.exe
PID 1564 wrote to memory of 2232	1564	cmd.exe	xcopy.exe
PID 1564 wrote to memory of 2232	1564	cmd.exe	xcopy.exe

C:\Windows\system32\cmd.exe
cmd /c "C:\Users\Admin\AppData\Local\Temp\hey\twelfth.bat"
1⤵
- Suspicious use of WriteProcessMemory
PID:1564
- C:\Windows\system32\xcopy.exe
  xcopy /s /i /e /h hey\superstring.dll C:\Users\Admin\AppData\Local\Temp\*
  2⤵
  PID:2232

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads