f6199fe0c5630f73c0cd588e71626ab8552fb312e90e441bbe6f1ebd50bc7ccb | Triage

Resubmissions

28-04-2024 18:37

240428-w9rt9sed4s 9

28-04-2024 18:36

240428-w875vsea56 9

Analysis

max time kernel
67s
max time network
53s
platform
windows10-2004_x64
resource
win10v2004-20240419-en
resource tags

arch:x64arch:x86image:win10v2004-20240419-enlocale:en-usos:windows10-2004-x64system
submitted
28-04-2024 18:36

Sharing

Report Analysis Logs

General

Target

MAC.cmd
Size

2KB
MD5

9bb3424ce0882c73682a407477af163e
SHA1

c50786f19c4301d186db5fc1b56b8824013f1207
SHA256

9c1cc4852d290f352f4ba6c6eca68a4ffb1fc19a514fbbda644855a7f23c0c61
SHA512

f530673e63f10f684416624f53aeeda6430a552d2d32b776f026e42f34e28b7f9f19bc6c61298dfaf0b5e1c104ad681433997646a277f889c9af2df9cec601ce

Score

1^/10

Malware Config

Signatures

Suspicious use of WriteProcessMemory 2 IoCs

Processes:

cmd.exe

description pid process target process

PID 4200 wrote to memory of 4724 4200 cmd.exe mode.com
PID 4200 wrote to memory of 4724 4200 cmd.exe mode.com

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\MAC.cmd"
1⤵
- Suspicious use of WriteProcessMemory
PID:4200

C:\Windows\system32\mode.com
mode con: cols=60 lines=8
2⤵
PID:4724

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...