022e498fe973889e1c2ad0964f0a097a87feb14ceb314a5c19c7ff5d9c7ebb36 | Triage™

Analysis

max time kernel
135s
max time network
137s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
28/05/2024, 10:23

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
AMI/spoof.bat
Size 57B
Sample240528-mexmlage85
SHA256 74975bffd064e9e27f44db7738b5f4c971ca1401b5e5d89f4aa50835801abb5c
MD5 70c372a580ee13ad16ff67d3cc0ff0c6
SHA1 7e92af45a827b70404573f9f8339b2c9297793ec
SHA512 8dd0f5cbf1e66061f11d9129b6da90046ffc36742b2884e271399f17f096dbaf5c1db80d2b4c3e4594961021c96e04c623c684c5c6511cfe6e64b5527d1e50ed
MD5 SHA1 SHA512

Score

1^/10

Malware Config

Signatures

Suspicious behavior: LoadsDriver 1 IoCs

pid	Process
656	Process not Found

Suspicious use of WriteProcessMemory 2 IoCs

description	pid	Process	procid_target
PID 4424 wrote to memory of 4332	4424	cmd.exe	84
PID 4424 wrote to memory of 4332	4424	cmd.exe	84

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\AMI\spoof.bat"
1⤵
- Suspicious use of WriteProcessMemory
PID:4424
- C:\Users\Admin\AppData\Local\Temp\AMI\AMIDEWINx64.EXE
  AMIDEWINx64.exe /SU AUTO
  2⤵
  PID:4332

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads