117d6569a86398643a68e7239f871b91566910ac2621740cb4974fe6a91d9815

Analysis

max time kernel
121s
max time network
122s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
21-02-2024 21:31

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

TuningPack-noguide-v65/Network/Misc/reset-tcp.bat
Size

151B
MD5

fc4032f5d7ddf6bbc02790f3f5b4b4e6
SHA1

d23ed8595c63ff92fa0971c58ffa67d99c7a2345
SHA256

1da3a9eba69f1b3b69bd32838f1adae927f356f5dcfb4af3f0d69e7dd6de8100
SHA512

5fd4cb43e8650e083a29bec4dc6989ae8cf51420ed6d82e055892be166b25024cf69180d0b84e3473211038f727ec9a29c17523ab0f66e982a55948d5634bed5

Score

1^/10

Malware Config

Signatures

Gathers network information 2 TTPs 4 IoCs

Uses commandline utility to view network configuration.

System Information Discovery

T1082

Command and Scripting Interpreter

T1059

pid	Process
3000	ipconfig.exe
2552	ipconfig.exe
2428	ipconfig.exe
2076	ipconfig.exe

Suspicious use of WriteProcessMemory 12 IoCs

description	pid	Process	procid_target
PID 1744 wrote to memory of 2428	1744	cmd.exe	29
PID 1744 wrote to memory of 2428	1744	cmd.exe	29
PID 1744 wrote to memory of 2428	1744	cmd.exe	29
PID 1744 wrote to memory of 2076	1744	cmd.exe	30
PID 1744 wrote to memory of 2076	1744	cmd.exe	30
PID 1744 wrote to memory of 2076	1744	cmd.exe	30
PID 1744 wrote to memory of 3000	1744	cmd.exe	31
PID 1744 wrote to memory of 3000	1744	cmd.exe	31
PID 1744 wrote to memory of 3000	1744	cmd.exe	31
PID 1744 wrote to memory of 2552	1744	cmd.exe	32
PID 1744 wrote to memory of 2552	1744	cmd.exe	32
PID 1744 wrote to memory of 2552	1744	cmd.exe	32

C:\Windows\system32\cmd.exe
cmd /c "C:\Users\Admin\AppData\Local\Temp\TuningPack-noguide-v65\Network\Misc\reset-tcp.bat"
1⤵
- Suspicious use of WriteProcessMemory
PID:1744
- C:\Windows\system32\ipconfig.exe
  ipconfig -release
  2⤵
  - Gathers network information
  PID:2428
- C:\Windows\system32\ipconfig.exe
  ipconfig -flushdns
  2⤵
  - Gathers network information
  PID:2076
- C:\Windows\system32\ipconfig.exe
  ipconfig -renew
  2⤵
  - Gathers network information
  PID:3000
- C:\Windows\system32\ipconfig.exe
  ipconfig -all
  2⤵
  - Gathers network information
  PID:2552

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads