fb1814fb9c9f6031ec7fa4edcbab17fe010b2e8677e0cb08cfd874d5774ac956 | Triage™

Analysis

max time kernel
148s
max time network
161s
platform
windows11-21h2_x64
resource
win11-20240221-en
resource tags

arch:x64arch:x86image:win11-20240221-enlocale:en-usos:windows11-21h2-x64system
submitted
22/02/2024, 19:07

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
Vantage/run.bat
Size 50B
Sample240222-xsp5saee37
SHA256 7590a48a4b70e26a36b7bfb9ac4f00ca4b25a0bdd1db6745c2a72f4831a001a3
MD5 c4d85e9f45ddc3a7dd196477ea1ad742
SHA1 5f09ead76fede7b50a7171d74fec287a22ab0dc9
SHA512 efbf8a8c0d0140d076a39262a47a6cf557e5cf7696e1f3f37d182dd096b96f62744610d8943b9d58cd2d63f066b2ef9d4eeb3363ba564a5d494970da04dc619b
MD5 SHA1 SHA512

Score

1^/10

Malware Config

Signatures

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 3168 wrote to memory of 1388	3168	cmd.exe	81
PID 3168 wrote to memory of 1388	3168	cmd.exe	81
PID 3168 wrote to memory of 1388	3168	cmd.exe	81

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\Vantage\run.bat"
1⤵
- Suspicious use of WriteProcessMemory
PID:3168
- C:\Program Files\WindowsApps\Microsoft.DesktopAppInstaller_1.0.42251.0_x64__8wekyb3d8bbwe\AppInstallerPythonRedirector.exe
  python Vantage.py
  2⤵
  PID:1388

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads