58691af22fbd8b84e66bd2d90b606ca66255319bf6077887fa784b83587c8ae3 | Triage

Analysis

max time kernel
15s
max time network
16s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
27-04-2024 01:59

Sharing

Report Analysis Logs

General

Target

bsod fix.bat
Size

415B
MD5

392f331dc1744fbe560a2a17d7ca838f
SHA1

817559945e137d036f47b26696d4fab5f22572c1
SHA256

318ae14fd3712848ed06c109d36a9df600964e1d827581f980c121d52a7b5df5
SHA512

0b1023402d8bf343cdee0e1e643209a65879dca4a7e22862b28ba08dea2d1a72ff651ab757ce32ad11add2aad61b44f36a64d1c754bdbe1ea740c44c2857c0dd

Score

1^/10

Malware Config

Signatures

Runs net.exe

Suspicious use of WriteProcessMemory 12 IoCs

Processes:

cmd.exenet.exe

description	pid	process	target process
PID 2176 wrote to memory of 2572	2176	cmd.exe	net.exe
PID 2176 wrote to memory of 2572	2176	cmd.exe	net.exe
PID 2176 wrote to memory of 2572	2176	cmd.exe	net.exe
PID 2572 wrote to memory of 2724	2572	net.exe	net1.exe
PID 2572 wrote to memory of 2724	2572	net.exe	net1.exe
PID 2572 wrote to memory of 2724	2572	net.exe	net1.exe
PID 2176 wrote to memory of 1880	2176	cmd.exe	reg.exe
PID 2176 wrote to memory of 1880	2176	cmd.exe	reg.exe
PID 2176 wrote to memory of 1880	2176	cmd.exe	reg.exe
PID 2176 wrote to memory of 3068	2176	cmd.exe	reg.exe
PID 2176 wrote to memory of 3068	2176	cmd.exe	reg.exe
PID 2176 wrote to memory of 3068	2176	cmd.exe	reg.exe

C:\Windows\system32\cmd.exe
cmd /c "C:\Users\Admin\AppData\Local\Temp\bsod fix.bat"
1⤵
- Suspicious use of WriteProcessMemory
PID:2176

C:\Windows\system32\net.exe
NET SESSION
2⤵
- Suspicious use of WriteProcessMemory
PID:2572

C:\Windows\system32\net1.exe
C:\Windows\system32\net1 SESSION
3⤵
PID:2724

C:\Windows\system32\reg.exe
reg add "HKLM\SYSTEM\CurrentControlSet\Control\Session Manager\Memory Management" /v FeatureSettingsOverride /t REG_DWORD /d 3
2⤵
PID:1880

C:\Windows\system32\reg.exe
reg add "HKLM\SYSTEM\CurrentControlSet\Control\Session Manager\Memory Management" /v FeatureSettingsOverrideMask /t REG_DWORD /d 3
2⤵
PID:3068

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...