ad272132970772ec9c1cf693f5aaee542a68c0f849d1b2eaaeebd0abf78e567a | Triage

Analysis

max time kernel
117s
max time network
118s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
27/03/2024, 06:57

Sharing

Report Analysis Logs

General

Target

SaveSettings.bat
Size

211B
MD5

28ad19cb3f03c4349c1f9dfcba13a12c
SHA1

08c4cde3d101ad11b121d215a74b460d380227ce
SHA256

6a35fe58e0a775c3878ca2f2b47ddb91e77ebc5bd483d9fc094452659de2ee9b
SHA512

277d8ab8f65764c55bb93c38765ae08bb98a40a03e69a3b3e5d2755ffaf790c14fd310fcc94ca6066802d3c64433b7e6551d219941dc49789efe43cf82cdd52f

Score

1^/10

Malware Config

Signatures

Runs .reg file with regedit 1 IoCs

pid	Process
2820	regedit.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2224 wrote to memory of 2820	2224	cmd.exe	29
PID 2224 wrote to memory of 2820	2224	cmd.exe	29
PID 2224 wrote to memory of 2820	2224	cmd.exe	29

C:\Windows\system32\cmd.exe
cmd /c "C:\Users\Admin\AppData\Local\Temp\SaveSettings.bat"
1⤵
- Suspicious use of WriteProcessMemory
PID:2224
- C:\Windows\regedit.exe
  regedit /e WinOrgSettings.reg "HKEY_CURRENT_USER\Software\WinOrganizer"
  2⤵
  - Runs .reg file with regedit
  PID:2820

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads