64fb9b3d5ed1876e0a610fc18a0750e9af8719ce04cdd87b8647464f18cbd9d6 | Triage

Analysis

max time kernel
134s
max time network
136s
platform
windows10-1703_x64
resource
win10-20240404-en
resource tags

arch:x64arch:x86image:win10-20240404-enlocale:en-usos:windows10-1703-x64system
submitted
12-05-2024 14:32

Sharing

Report Analysis Logs

General

Target

wanyria.cc/libaries/RUS.bat
Size

38B
MD5

88fecce206498e4d417101c2ae6ca2b7
SHA1

b23f50184b340c61566d4d7b10094a11ad8c0bb1
SHA256

2c6930f0638ce41a1ea1c66d68864b77d34c359453bb7e52bdeee0e00f59b270
SHA512

7005d126d02e9e6e74780ba10029ff4d3659ad7fc89fd83ddbaa94137d3e5e7b2b9afa33261a06bff28dde4a139b83d2576e94c60f08e9eab7b54f6fb156aa0c

Score

1^/10

Malware Config

Signatures

Modifies registry class 1 IoCs

Processes:

cmd.exe

description ioc process

Key created \REGISTRY\USER\S-1-5-21-160447019-1232603106-4168707212-1000_Classes\Local Settings cmd.exe
Suspicious use of SetWindowsHookEx 1 IoCs

Processes:

OpenWith.exe

pid process

5072 OpenWith.exe

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\wanyria.cc\libaries\RUS.bat"
1⤵
- Modifies registry class
PID:4740

C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
1⤵
- Suspicious use of SetWindowsHookEx
PID:5072

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads