0db9ac02645846b5033b403a818544371046214bfedef7e70d44f5f825713c00 | Triage

Analysis

max time kernel
132s
max time network
171s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
26-03-2024 08:59

Sharing

Report Analysis Logs

General

Target

start_service.bat
Size

37B
MD5

c9ff6e7e247a37749dad7cb9b7349251
SHA1

cea1a1e73910cd730e0e85e773e526b57cc87675
SHA256

be91ec759719207ec13d62ee479cdac7e7b7effac7515b59ef834bbec44d484f
SHA512

2c9e0992e951740f25983768348d8e672ff1aaedf29b2a645b8b377c2be347c8864a43f9e99d25f634fac3bd68841a901890ad193718c48cea9108caef982325

Score

1^/10

Malware Config

Signatures

Suspicious use of FindShellTrayWindow 2 IoCs

pid	Process
1648	WeaselServer.exe
1648	WeaselServer.exe

Suspicious use of SendNotifyMessage 2 IoCs

pid	Process
1648	WeaselServer.exe
1648	WeaselServer.exe

Suspicious use of WriteProcessMemory 2 IoCs

description	pid	Process	procid_target
PID 2384 wrote to memory of 1648	2384	cmd.exe	95
PID 2384 wrote to memory of 1648	2384	cmd.exe	95

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\start_service.bat"
1⤵
- Suspicious use of WriteProcessMemory
PID:2384
- C:\Users\Admin\AppData\Local\Temp\WeaselServer.exe
  WeaselServer.exe
  2⤵
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SendNotifyMessage
  PID:1648

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=3500 --field-trial-handle=2244,i,11878111470816612087,2265290141962607370,262144 --variations-seed-version /prefetch:8
1⤵
PID:2104

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads