67001c8f5a37c1ccd2d1750f21e28d372a8639c330aafbae111a5956c942b71a | Triage

Analysis

max time kernel
118s
max time network
122s
platform
windows7_x64
resource
win7-20240215-en
resource tags

arch:x64arch:x86image:win7-20240215-enlocale:en-usos:windows7-x64system
submitted
15-03-2024 09:30

Sharing

Report Analysis Logs

General

Target

driver/vista/install.bat
Size

16B
MD5

903b157dca56861c845179d4d1c5e930
SHA1

e6b5ed1511f1f14f0436ca474ff457cb340e7c60
SHA256

8402e0c9189fa6ef6ef8e955606c5a20f880f1106ea5f81304e42a0864f078f8
SHA512

53f5be22fd9b12ff9d084a65be63bfa7a9b5489a5d95263343ee0db3ce749b1b6d0999ac3cc34b23a4a970f3f02dd7ed1199269c12c8b59313ff58b225774006

Score

1^/10

Malware Config

Signatures

Suspicious behavior: CmdExeWriteProcessMemorySpam 1 IoCs

pid	Process
1244	setupdrv.exe

Suspicious use of AdjustPrivilegeToken 7 IoCs

description	pid	Process
Token: SeRestorePrivilege	1244	setupdrv.exe
Token: SeRestorePrivilege	1244	setupdrv.exe
Token: SeRestorePrivilege	1244	setupdrv.exe
Token: SeRestorePrivilege	1244	setupdrv.exe
Token: SeRestorePrivilege	1244	setupdrv.exe
Token: SeRestorePrivilege	1244	setupdrv.exe
Token: SeRestorePrivilege	1244	setupdrv.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2904 wrote to memory of 1244	2904	cmd.exe	29
PID 2904 wrote to memory of 1244	2904	cmd.exe	29
PID 2904 wrote to memory of 1244	2904	cmd.exe	29
PID 2904 wrote to memory of 1244	2904	cmd.exe	29
PID 2904 wrote to memory of 1244	2904	cmd.exe	29
PID 2904 wrote to memory of 1244	2904	cmd.exe	29
PID 2904 wrote to memory of 1244	2904	cmd.exe	29

C:\Windows\system32\cmd.exe
cmd /c "C:\Users\Admin\AppData\Local\Temp\driver\vista\install.bat"
1⤵
- Suspicious use of WriteProcessMemory
PID:2904
- C:\Users\Admin\AppData\Local\Temp\driver\vista\setupdrv.exe
  setupdrv install
  2⤵
  - Suspicious behavior: CmdExeWriteProcessMemorySpam
  - Suspicious use of AdjustPrivilegeToken
  PID:1244

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads