ad272132970772ec9c1cf693f5aaee542a68c0f849d1b2eaaeebd0abf78e567a | Triage

Analysis

max time kernel
149s
max time network
152s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
27/03/2024, 06:57

Sharing

Report Analysis Logs

General

Target

SaveSettings.bat
Size

211B
MD5

28ad19cb3f03c4349c1f9dfcba13a12c
SHA1

08c4cde3d101ad11b121d215a74b460d380227ce
SHA256

6a35fe58e0a775c3878ca2f2b47ddb91e77ebc5bd483d9fc094452659de2ee9b
SHA512

277d8ab8f65764c55bb93c38765ae08bb98a40a03e69a3b3e5d2755ffaf790c14fd310fcc94ca6066802d3c64433b7e6551d219941dc49789efe43cf82cdd52f

Score

1^/10

Malware Config

Signatures

Runs .reg file with regedit 1 IoCs

pid	Process
1596	regedit.exe

Suspicious use of WriteProcessMemory 2 IoCs

description	pid	Process	procid_target
PID 1696 wrote to memory of 1596	1696	cmd.exe	89
PID 1696 wrote to memory of 1596	1696	cmd.exe	89

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\SaveSettings.bat"
1⤵
- Suspicious use of WriteProcessMemory
PID:1696
- C:\Windows\regedit.exe
  regedit /e WinOrgSettings.reg "HKEY_CURRENT_USER\Software\WinOrganizer"
  2⤵
  - Runs .reg file with regedit
  PID:1596

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads