1e4a3728964bb563b80ee9b4ff95b4e97ca3e80b1daf7d41c8c967617e36ca7d | Triage

Analysis

max time kernel
118s
max time network
122s
platform
windows7_x64
resource
win7-20240319-en
resource tags

arch:x64arch:x86image:win7-20240319-enlocale:en-usos:windows7-x64system
submitted
15/04/2024, 05:05

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

JamessJ.bat
Size

1KB
MD5

85144ac8c4cf3a68eadca7d4077d1b9c
SHA1

c0bc8a9305838f1a74b66326e5823478b92cfdc7
SHA256

1e4a3728964bb563b80ee9b4ff95b4e97ca3e80b1daf7d41c8c967617e36ca7d
SHA512

041dceadfaf81f820affac2aef77c0881c524e04de902aef7d975d48806628805e487d408cbf58af1065d0d1befc210c7e197e4e7d5092cabdb88bc01ccd6985

Score

7^/10

Malware Config

Signatures

Deletes itself 1 IoCs

pid	Process
2276	cmd.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2276 wrote to memory of 1624	2276	cmd.exe	29
PID 2276 wrote to memory of 1624	2276	cmd.exe	29
PID 2276 wrote to memory of 1624	2276	cmd.exe	29

C:\Windows\system32\cmd.exe
cmd /c "C:\Users\Admin\AppData\Local\Temp\JamessJ.bat"
1⤵
- Deletes itself
- Suspicious use of WriteProcessMemory
PID:2276
- C:\Windows\system32\mode.com
  mode con: cols=20 lines=1
  2⤵
  PID:1624

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads