d4f575cced861efb0d1d18469cc0ec6da2df483bfee7e1b22769f1d088e12dc4 | Triage

Analysis

max time kernel
120s
max time network
122s
platform
windows7_x64
resource
win7-20240220-en
resource tags

arch:x64arch:x86image:win7-20240220-enlocale:en-usos:windows7-x64system
submitted
19-04-2024 07:38

Sharing

Report Analysis Logs

General

Target

google/version.bat
Size

2KB
MD5

9ae07d6712738911e152d68f131ff92d
SHA1

dad1b3e80fcf87a39e14577eb8421cf5baccf9f8
SHA256

7ed6a024ab99ca25ac07d8484d53b8846493f17d8dfdfe941732433de5bac12b
SHA512

2e603bcd8ec0e5c71ea8e0ad01acca94270c8b756d92af40a8f0d4edd3f5e5e503f4b9a1968105f1d32b39b2be7ad27692fd7feb31e1b308bf285954c7040805

Score

1^/10

Malware Config

Signatures

Suspicious use of WriteProcessMemory 9 IoCs

Processes:

cmd.execmd.exe

description	pid	process	target process
PID 2272 wrote to memory of 2976	2272	cmd.exe	cmd.exe
PID 2272 wrote to memory of 2976	2272	cmd.exe	cmd.exe
PID 2272 wrote to memory of 2976	2272	cmd.exe	cmd.exe
PID 2976 wrote to memory of 352	2976	cmd.exe	cmd.exe
PID 2976 wrote to memory of 352	2976	cmd.exe	cmd.exe
PID 2976 wrote to memory of 352	2976	cmd.exe	cmd.exe
PID 2976 wrote to memory of 2936	2976	cmd.exe	cmd.exe
PID 2976 wrote to memory of 2936	2976	cmd.exe	cmd.exe
PID 2976 wrote to memory of 2936	2976	cmd.exe	cmd.exe

C:\Windows\system32\cmd.exe
cmd /c "C:\Users\Admin\AppData\Local\Temp\google\version.bat"
1⤵
- Suspicious use of WriteProcessMemory
PID:2272

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /K "C:\Users\Admin\AppData\Local\Temp\google\version.bat" MY_FLAG
2⤵
- Suspicious use of WriteProcessMemory
PID:2976

C:\Windows\system32\cmd.exe
cmd /c ""C:\Users\Admin\Pictures\kam.cmd""
3⤵
PID:352

C:\Windows\system32\cmd.exe
cmd /c ""C:\Users\Admin\Pictures\las.cmd""
3⤵
PID:2936

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...