fb1814fb9c9f6031ec7fa4edcbab17fe010b2e8677e0cb08cfd874d5774ac956 | Triage

Analysis

max time kernel
148s
max time network
161s
platform
windows11-21h2_x64
resource
win11-20240221-en
resource tags

arch:x64arch:x86image:win11-20240221-enlocale:en-usos:windows11-21h2-x64system
submitted
22-02-2024 19:07

Sharing

Report Analysis Logs

General

Target

Vantage/run.bat
Size

50B
MD5

c4d85e9f45ddc3a7dd196477ea1ad742
SHA1

5f09ead76fede7b50a7171d74fec287a22ab0dc9
SHA256

7590a48a4b70e26a36b7bfb9ac4f00ca4b25a0bdd1db6745c2a72f4831a001a3
SHA512

efbf8a8c0d0140d076a39262a47a6cf557e5cf7696e1f3f37d182dd096b96f62744610d8943b9d58cd2d63f066b2ef9d4eeb3363ba564a5d494970da04dc619b

Score

1^/10

Malware Config

Signatures

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 3168 wrote to memory of 1388	3168	cmd.exe	81
PID 3168 wrote to memory of 1388	3168	cmd.exe	81
PID 3168 wrote to memory of 1388	3168	cmd.exe	81

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\Vantage\run.bat"
1⤵
- Suspicious use of WriteProcessMemory
PID:3168
- C:\Program Files\WindowsApps\Microsoft.DesktopAppInstaller_1.0.42251.0_x64__8wekyb3d8bbwe\AppInstallerPythonRedirector.exe
  python Vantage.py
  2⤵
  PID:1388

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads