117d6569a86398643a68e7239f871b91566910ac2621740cb4974fe6a91d9815

Analysis

max time kernel
92s
max time network
126s
platform
windows10-2004_x64
resource
win10v2004-20240221-en
resource tags

arch:x64arch:x86image:win10v2004-20240221-enlocale:en-usos:windows10-2004-x64system
submitted
21/02/2024, 21:31

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

TuningPack-noguide-v65/Network/Misc/reset-tcp.bat
Size

151B
MD5

fc4032f5d7ddf6bbc02790f3f5b4b4e6
SHA1

d23ed8595c63ff92fa0971c58ffa67d99c7a2345
SHA256

1da3a9eba69f1b3b69bd32838f1adae927f356f5dcfb4af3f0d69e7dd6de8100
SHA512

5fd4cb43e8650e083a29bec4dc6989ae8cf51420ed6d82e055892be166b25024cf69180d0b84e3473211038f727ec9a29c17523ab0f66e982a55948d5634bed5

Score

1^/10

Malware Config

Signatures

Gathers network information 2 TTPs 4 IoCs

Uses commandline utility to view network configuration.

System Information Discovery

T1082

Command and Scripting Interpreter

T1059

pid	Process
860	ipconfig.exe
1972	ipconfig.exe
3768	ipconfig.exe
1260	ipconfig.exe

Suspicious use of WriteProcessMemory 8 IoCs

description	pid	Process	procid_target
PID 4880 wrote to memory of 860	4880	cmd.exe	86
PID 4880 wrote to memory of 860	4880	cmd.exe	86
PID 4880 wrote to memory of 1972	4880	cmd.exe	87
PID 4880 wrote to memory of 1972	4880	cmd.exe	87
PID 4880 wrote to memory of 3768	4880	cmd.exe	88
PID 4880 wrote to memory of 3768	4880	cmd.exe	88
PID 4880 wrote to memory of 1260	4880	cmd.exe	90
PID 4880 wrote to memory of 1260	4880	cmd.exe	90

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\TuningPack-noguide-v65\Network\Misc\reset-tcp.bat"
1⤵
- Suspicious use of WriteProcessMemory
PID:4880
- C:\Windows\system32\ipconfig.exe
  ipconfig -release
  2⤵
  - Gathers network information
  PID:860
- C:\Windows\system32\ipconfig.exe
  ipconfig -flushdns
  2⤵
  - Gathers network information
  PID:1972
- C:\Windows\system32\ipconfig.exe
  ipconfig -renew
  2⤵
  - Gathers network information
  PID:3768
- C:\Windows\system32\ipconfig.exe
  ipconfig -all
  2⤵
  - Gathers network information
  PID:1260

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Windows 7 deprecation

Loading Replay Monitor...