3119021ddf61b459966983b78382dc52c111170bcce4af6f599dcbf077a68e60 | Triage

Analysis

max time kernel
235s
max time network
252s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
21/05/2024, 04:39

Sharing

Report Analysis Logs

General

Target

420NUDuOmL.bat
Size

268B
MD5

0113bbdc749ff55c8c3f62db817d6b7a
SHA1

fb068b180e4f0a6c53e6a2c8c1977459b48454b9
SHA256

3119021ddf61b459966983b78382dc52c111170bcce4af6f599dcbf077a68e60
SHA512

7abd9da0b3753931e6f4f0f0bcf4cf1a9febf7db3e788f8272c896ab3fde95650e5a8e7094ee593fe6375e06d307e62cbb939f758eabef6d0c817277c11b0e1d

Score

1^/10

Malware Config

Signatures

Opens file in notepad (likely ransom note) 1 IoCs

pid	Process
1240	NOTEPAD.EXE

Suspicious use of WriteProcessMemory 2 IoCs

description	pid	Process	procid_target
PID 5060 wrote to memory of 3968	5060	cmd.exe	91
PID 5060 wrote to memory of 3968	5060	cmd.exe	91

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\420NUDuOmL.bat"
1⤵
- Suspicious use of WriteProcessMemory
PID:5060
- C:\Windows\system32\curl.exe
  curl -L "$url" -o "$filename"
  2⤵
  PID:3968

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --field-trial-handle=4048,i,15140928051103392835,1612840580898364401,262144 --variations-seed-version --mojo-platform-channel-handle=4836 /prefetch:8
1⤵
PID:3432

C:\Windows\System32\NOTEPAD.EXE
"C:\Windows\System32\NOTEPAD.EXE" C:\Users\Admin\Desktop\test.bat
1⤵
- Opens file in notepad (likely ransom note)
PID:1240

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads