Analysis
-
max time kernel
149s -
max time network
150s -
platform
windows10-2004_x64 -
resource
win10v2004-20240508-en -
resource tags
arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system -
submitted
01-06-2024 04:46
Static task
static1
Behavioral task
behavioral1
Sample
bsod fix.bat
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
bsod fix.bat
Resource
win10v2004-20240508-en
Behavioral task
behavioral3
Sample
u237cgatAh2.exe
Resource
win7-20240221-en
Behavioral task
behavioral4
Sample
u237cgatAh2.exe
Resource
win10v2004-20240226-en
Behavioral task
behavioral5
Sample
w11 fix.bat
Resource
win7-20231129-en
Behavioral task
behavioral6
Sample
w11 fix.bat
Resource
win10v2004-20240426-en
General
-
Target
bsod fix.bat
-
Size
415B
-
MD5
392f331dc1744fbe560a2a17d7ca838f
-
SHA1
817559945e137d036f47b26696d4fab5f22572c1
-
SHA256
318ae14fd3712848ed06c109d36a9df600964e1d827581f980c121d52a7b5df5
-
SHA512
0b1023402d8bf343cdee0e1e643209a65879dca4a7e22862b28ba08dea2d1a72ff651ab757ce32ad11add2aad61b44f36a64d1c754bdbe1ea740c44c2857c0dd
Malware Config
Signatures
-
Runs net.exe
-
Suspicious use of WriteProcessMemory 6 IoCs
description pid Process procid_target PID 4356 wrote to memory of 1612 4356 cmd.exe 86 PID 4356 wrote to memory of 1612 4356 cmd.exe 86 PID 1612 wrote to memory of 832 1612 net.exe 87 PID 1612 wrote to memory of 832 1612 net.exe 87 PID 4356 wrote to memory of 2952 4356 cmd.exe 88 PID 4356 wrote to memory of 2952 4356 cmd.exe 88
Processes
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\bsod fix.bat"1⤵
- Suspicious use of WriteProcessMemory
PID:4356 -
C:\Windows\system32\net.exeNET SESSION2⤵
- Suspicious use of WriteProcessMemory
PID:1612 -
C:\Windows\system32\net1.exeC:\Windows\system32\net1 SESSION3⤵PID:832
-
-
-
C:\Windows\system32\reg.exereg add "HKLM\SYSTEM\CurrentControlSet\Control\Session Manager\Memory Management" /v FeatureSettingsOverride /t REG_DWORD /d 32⤵PID:2952
-