0625f84f174f72e98cb67251a549638b8997012701ae7e47d6fa348567bfd7ba

Analysis

max time kernel
120s
max time network
123s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
09/03/2024, 10:58

Target

file.bat
Size

104B
MD5

f153d51505dbb3e9a190aae6a7269a72
SHA1

9d9c99e0142f200c00e8a4dcc65eeecfaa3cc17e
SHA256

19591e0a956e524775f97d628f897883e99a57cb845eab24a1be9a172bd6f458
SHA512

5c30328972573203cdfc65f9f435f7e720c7d45bc073f1971d706a112e780064416418e922b0078c78d4c5c0b798810667a5cf610bbe03472ee4e981eac08dfc

Score

1^/10

Suspicious behavior: CmdExeWriteProcessMemorySpam 2 IoCs

pid	Process
1940	mgxitt.exe
2812	mgxitt.exe

Suspicious use of AdjustPrivilegeToken 8 IoCs

Suspicious use of WriteProcessMemory 8 IoCs

description	pid	Process	procid_target
PID 2180 wrote to memory of 1940	2180	cmd.exe	29
PID 2180 wrote to memory of 1940	2180	cmd.exe	29
PID 2180 wrote to memory of 1940	2180	cmd.exe	29
PID 2180 wrote to memory of 1940	2180	cmd.exe	29
PID 2180 wrote to memory of 2812	2180	cmd.exe	30
PID 2180 wrote to memory of 2812	2180	cmd.exe	30
PID 2180 wrote to memory of 2812	2180	cmd.exe	30
PID 2180 wrote to memory of 2812	2180	cmd.exe	30

C:\Windows\system32\cmd.exe
cmd /c "C:\Users\Admin\AppData\Local\Temp\file.bat"
1⤵
- Suspicious use of WriteProcessMemory
PID:2180
- C:\Users\Admin\AppData\Local\Temp\mgxitt.exe
  mgxitt.exe x oxsbaszf.dll -p123456789
  2⤵
  - Suspicious behavior: CmdExeWriteProcessMemorySpam
  - Suspicious use of AdjustPrivilegeToken
  PID:1940
- C:\Users\Admin\AppData\Local\Temp\mgxitt.exe
  mgxitt.exe x uwaufnjs.dat -p123456789
  2⤵
  - Suspicious behavior: CmdExeWriteProcessMemorySpam
  - Suspicious use of AdjustPrivilegeToken
  PID:2812