5ce288360788f8f5c149080dd08f430989398a269be0c71ce99c8822e8b16bf7 | Triage

Analysis

max time kernel
93s
max time network
111s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
09/05/2024, 10:21

Sharing

Report Analysis Logs

General

Target

funtest.bat
Size

582B
MD5

b040b4a3bcb57a7aa356343a304309a2
SHA1

1aca74c24d391c1a677788c6bcbe1732dc829d6e
SHA256

5ce288360788f8f5c149080dd08f430989398a269be0c71ce99c8822e8b16bf7
SHA512

e4ff10551445d520571b29d6eb87976885d70b4364e86d685394651192a319e535721f31257ea776d3715a95bcaa658ad245b4914f4f91800f3827e010608fe2

Score

8^/10

Malware Config

Signatures

Blocklisted process makes network request 3 IoCs

flow	pid	Process
8	1720	mshta.exe
10	1720	mshta.exe
12	1720	mshta.exe

Suspicious use of WriteProcessMemory 2 IoCs

description	pid	Process	procid_target
PID 2248 wrote to memory of 1720	2248	cmd.exe	84
PID 2248 wrote to memory of 1720	2248	cmd.exe	84

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\funtest.bat"
1⤵
- Suspicious use of WriteProcessMemory
PID:2248
- C:\Windows\system32\mshta.exe
  mshta.exe "C:\Users\Admin\AppData\Local\Temp\funtest.bat"
  2⤵
  - Blocklisted process makes network request
  PID:1720

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads