376c244a85ecd70f32daeb1a1022f0540682526ee8618b1d1b3b5489fc2de5ef

Analysis

max time kernel
133s
max time network
105s
platform
windows10-2004_x64
resource
win10v2004-20240419-en
resource tags

arch:x64arch:x86image:win10v2004-20240419-enlocale:en-usos:windows10-2004-x64system
submitted
04/05/2024, 11:03

Target
New folder/tmp5D.tmp.bat
Size 141B
Sample240504-m5ymksca5z
SHA256 3c2f526c09966bbf9e68b47afcd3319041631c320299ddc5d63d93d9f83c3fca
MD5 653ce79799a658a903d330c3cdb89832
SHA1 85b2938579892d3c7a21e8c7fed952d9f733372b
SHA512 2e0ab6483f19915fb101beabfab3c8f3e56662f8e3688ae6ba5ad9c11eb37cf3e8ee4f1c7fe88ed0bc0e6a03cb286d8d79d7b8b22fb9a5cc819b213dec98afc9
MD5 SHA1 SHA512

Score

3^/10

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Delays execution with timeout.exe 1 IoCs

evasion

pid	Process
3500	timeout.exe

Suspicious use of WriteProcessMemory 2 IoCs

description	pid	Process	procid_target
PID 2808 wrote to memory of 3500	2808	cmd.exe	85
PID 2808 wrote to memory of 3500	2808	cmd.exe	85

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\New folder\tmp5D.tmp.bat"
1⤵
- Suspicious use of WriteProcessMemory
PID:2808
- C:\Windows\system32\timeout.exe
  timeout 3
  2⤵
  - Delays execution with timeout.exe
  PID:3500

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact