Resubmissions
26/02/2024, 22:46
240226-2qdfesag6w 820/02/2024, 23:03
240220-217f9agf65 820/02/2024, 22:49
240220-2rnmsaga51 9Analysis
-
max time kernel
142s -
max time network
150s -
platform
windows10-2004_x64 -
resource
win10v2004-20231215-en -
resource tags
arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system -
submitted
20/02/2024, 22:49
Static task
static1
Behavioral task
behavioral1
Sample
CARTI_TWEAKS.bat
Resource
win7-20231129-en
1 signatures
150 seconds
Behavioral task
behavioral2
Sample
CARTI_TWEAKS.bat
Resource
win10v2004-20231215-en
2 signatures
150 seconds
General
-
Target
CARTI_TWEAKS.bat
-
Size
59KB
-
MD5
ce77350d95772ad65718ecc8962b5517
-
SHA1
cf39eea9b027b8eafc99ee4de7a550c098927483
-
SHA256
b38f572ee0579f3f94e9f04a8040ed15ae6db151714ececfa0092ad2d524a97d
-
SHA512
a03c9209c26ee463ee685c24984ebbc3730079182e72009a2a54f92a8adf21e5d48afe2f1083dd99cca404f369acfc7e55e02386278c4acba7727f18d61e0ed5
-
SSDEEP
768:7RUPTtGiZQVr6+6Pk6PpXDrRDPqoYC7C6Wgm:7Wugm
Score
9/10
Malware Config
Signatures
-
Modifies boot configuration data using bcdedit 1 TTPs 2 IoCs
pid Process 4308 bcdedit.exe 2780 bcdedit.exe -
Suspicious use of WriteProcessMemory 8 IoCs
description pid Process procid_target PID 596 wrote to memory of 988 596 cmd.exe 85 PID 596 wrote to memory of 988 596 cmd.exe 85 PID 596 wrote to memory of 4308 596 cmd.exe 94 PID 596 wrote to memory of 4308 596 cmd.exe 94 PID 596 wrote to memory of 2780 596 cmd.exe 95 PID 596 wrote to memory of 2780 596 cmd.exe 95 PID 596 wrote to memory of 1968 596 cmd.exe 97 PID 596 wrote to memory of 1968 596 cmd.exe 97
Processes
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\CARTI_TWEAKS.bat"1⤵
- Suspicious use of WriteProcessMemory
PID:596 -
C:\Windows\system32\chcp.comchcp 650012⤵PID:988
-
-
C:\Windows\system32\bcdedit.exebcdedit /set disabledynamictick yes2⤵
- Modifies boot configuration data using bcdedit
PID:4308
-
-
C:\Windows\system32\bcdedit.exebcdedit /set useplatformtick yes2⤵
- Modifies boot configuration data using bcdedit
PID:2780
-
-
C:\Windows\system32\sfc.exeSFC /scannow2⤵PID:1968
-