ec4a958ab73fa233b4bb5cbaf68ea3486384997d53740bfa9c3307ce150a59dd

Analysis

max time kernel
121s
max time network
122s
platform
windows7_x64
resource
win7-20240215-en
resource tags

arch:x64arch:x86image:win7-20240215-enlocale:en-usos:windows7-x64system
submitted
27/04/2024, 14:16

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

FixInstall.bat
Size

2KB
MD5

6995c16f3fc3f788fd9e3e9c801f9758
SHA1

2eec9a249b77abee855de6e771ce69fa64b053ce
SHA256

0eef66a27fec8d6f74f1037dabdca0094c5c877606d33185fb560f26ecb08af1
SHA512

2e0f6730e5a28839fc664f397e6d56db48ba1fe8ce59dca8ccc506f2c2b0ce83e548097c84d3dc2a569ee36c32ff8eceb4668394d39d07a387fdbb998d3062cc

Score

1^/10

Malware Config

Signatures

Suspicious use of WriteProcessMemory 36 IoCs

description	pid	Process	procid_target
PID 2868 wrote to memory of 2900	2868	cmd.exe	29
PID 2868 wrote to memory of 2900	2868	cmd.exe	29
PID 2868 wrote to memory of 2900	2868	cmd.exe	29
PID 2900 wrote to memory of 2988	2900	cmd.exe	30
PID 2900 wrote to memory of 2988	2900	cmd.exe	30
PID 2900 wrote to memory of 2988	2900	cmd.exe	30
PID 2900 wrote to memory of 2552	2900	cmd.exe	31
PID 2900 wrote to memory of 2552	2900	cmd.exe	31
PID 2900 wrote to memory of 2552	2900	cmd.exe	31
PID 2868 wrote to memory of 2924	2868	cmd.exe	32
PID 2868 wrote to memory of 2924	2868	cmd.exe	32
PID 2868 wrote to memory of 2924	2868	cmd.exe	32
PID 2924 wrote to memory of 2056	2924	cmd.exe	33
PID 2924 wrote to memory of 2056	2924	cmd.exe	33
PID 2924 wrote to memory of 2056	2924	cmd.exe	33
PID 2924 wrote to memory of 2568	2924	cmd.exe	34
PID 2924 wrote to memory of 2568	2924	cmd.exe	34
PID 2924 wrote to memory of 2568	2924	cmd.exe	34
PID 2868 wrote to memory of 2616	2868	cmd.exe	35
PID 2868 wrote to memory of 2616	2868	cmd.exe	35
PID 2868 wrote to memory of 2616	2868	cmd.exe	35
PID 2616 wrote to memory of 2620	2616	cmd.exe	36
PID 2616 wrote to memory of 2620	2616	cmd.exe	36
PID 2616 wrote to memory of 2620	2616	cmd.exe	36
PID 2616 wrote to memory of 2640	2616	cmd.exe	37
PID 2616 wrote to memory of 2640	2616	cmd.exe	37
PID 2616 wrote to memory of 2640	2616	cmd.exe	37
PID 2868 wrote to memory of 2636	2868	cmd.exe	38
PID 2868 wrote to memory of 2636	2868	cmd.exe	38
PID 2868 wrote to memory of 2636	2868	cmd.exe	38
PID 2636 wrote to memory of 2772	2636	cmd.exe	39
PID 2636 wrote to memory of 2772	2636	cmd.exe	39
PID 2636 wrote to memory of 2772	2636	cmd.exe	39
PID 2636 wrote to memory of 2760	2636	cmd.exe	40
PID 2636 wrote to memory of 2760	2636	cmd.exe	40
PID 2636 wrote to memory of 2760	2636	cmd.exe	40

C:\Windows\system32\cmd.exe
cmd /c "C:\Users\Admin\AppData\Local\Temp\FixInstall.bat"
1⤵
- Suspicious use of WriteProcessMemory
PID:2868
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c reg query "HKLM\SYSTEM\CurrentControlSet\Services\npcap\Parameters" /v "Dot11Support" 2>nul | find "Dot11Support"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2900
- - C:\Windows\system32\reg.exe
    reg query "HKLM\SYSTEM\CurrentControlSet\Services\npcap\Parameters" /v "Dot11Support"
    3⤵
    PID:2988
- - C:\Windows\system32\find.exe
    find "Dot11Support"
    3⤵
    PID:2552
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c reg query "HKLM\SYSTEM\CurrentControlSet\Services\npcap\Parameters" /v "LoopbackAdapter" 2>nul | find "LoopbackAdapter"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2924
- - C:\Windows\system32\reg.exe
    reg query "HKLM\SYSTEM\CurrentControlSet\Services\npcap\Parameters" /v "LoopbackAdapter"
    3⤵
    PID:2056
- - C:\Windows\system32\find.exe
    find "LoopbackAdapter"
    3⤵
    PID:2568
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c reg query "HKLM\Software\WOW6432Node\Npcap" /ve 2>nul | find "REG_SZ"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2616
- - C:\Windows\system32\reg.exe
    reg query "HKLM\Software\WOW6432Node\Npcap" /ve
    3⤵
    PID:2620
- - C:\Windows\system32\find.exe
    find "REG_SZ"
    3⤵
    PID:2640
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c reg query "HKLM\Software\Npcap" /ve 2>nul | find "REG_SZ"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2636
- - C:\Windows\system32\reg.exe
    reg query "HKLM\Software\Npcap" /ve
    3⤵
    PID:2772
- - C:\Windows\system32\find.exe
    find "REG_SZ"
    3⤵
    PID:2760

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads