0fb7388c69ef9d2d892e6edc7eff8c86ce6f6659c88d347234acaa1a382e22ba | Triage

Resubmissions

14-02-2024 18:44

240214-xdwzsaab4v 10

14-02-2024 18:41

240214-xbw7rsaa8v 3

14-02-2024 18:37

240214-w9vk6aaa4w 10

Analysis

max time kernel
150s
max time network
153s
platform
windows10-1703_x64
resource
win10-20231215-en
resource tags

arch:x64arch:x86image:win10-20231215-enlocale:en-usos:windows10-1703-x64system
submitted
14-02-2024 18:44

Sharing

Report Analysis Logs

General

Target

hey/twelfth.bat
Size

1KB
MD5

4e7c3ec7e4db2756209f5190355c3716
SHA1

183a6caaba0208f8bdfe3bf7e25f069ecddf19f5
SHA256

f2178583f6008d7ade32bb218bcd5d846859ce059875b4f603e18be57a59c7a8
SHA512

d3f3ddef38d17b9b2ac209719d6bcc83d13053abc9a97e4055f1b899fbfdba054317a5c94e2a688637b18440adb120065a89a7de5ae6b84ef7b91b8922bdd768

Score

1^/10

Malware Config

Signatures

Suspicious use of WriteProcessMemory 2 IoCs

Processes:

cmd.exe

description pid process target process

PID 2640 wrote to memory of 3756 2640 cmd.exe xcopy.exe
PID 2640 wrote to memory of 3756 2640 cmd.exe xcopy.exe

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\hey\twelfth.bat"
1⤵
- Suspicious use of WriteProcessMemory
PID:2640
- C:\Windows\system32\xcopy.exe
  xcopy /s /i /e /h hey\superstring.dll C:\Users\Admin\AppData\Local\Temp\*
  2⤵
  PID:3756

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads