e5ac9e35df655c6014503b3f3c0cf7beca2839798f973e031b353d8f58679bea | Triage

Resubmissions

25-05-2024 08:12

240525-j3vw5abc6y 1

Analysis

max time kernel
120s
max time network
121s
platform
windows7_x64
resource
win7-20240508-en
resource tags

arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system
submitted
25-05-2024 08:12

Sharing

Report Analysis Logs

General

Target

Launcher.bat
Size

722B
MD5

d3536bea5d026490a43f81ce81f8af36
SHA1

9dfae9303c3cc6059dde651de143d692bd250715
SHA256

e5ac9e35df655c6014503b3f3c0cf7beca2839798f973e031b353d8f58679bea
SHA512

1fcd1685d10adb21011a7125dc75e8e1c39652bd04a13d511a8c4b7bea6fb8e1df7fd6c4289b6c754e658cd30d765952b8a2b985c66f58255f16ba59406df5a5

Score

1^/10

Malware Config

Signatures

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 1264 wrote to memory of 1844	1264	cmd.exe	29
PID 1264 wrote to memory of 1844	1264	cmd.exe	29
PID 1264 wrote to memory of 1844	1264	cmd.exe	29

C:\Windows\system32\cmd.exe
cmd /c "C:\Users\Admin\AppData\Local\Temp\Launcher.bat"
1⤵
- Suspicious use of WriteProcessMemory
PID:1264
- C:\Windows\system32\cacls.exe
  "C:\Windows\system32\cacls.exe" "C:\Windows\system32\config\system"
  2⤵
  PID:1844

C:\Windows\explorer.exe
"C:\Windows\explorer.exe"
1⤵
PID:1704

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads