8dbbd25935e2afbb8ec24997b1035783748f6581aee0afb913aa91b607d106db | Triage

Analysis

max time kernel
128s
max time network
102s
platform
windows10-2004_x64
resource
win10v2004-20240426-en
resource tags

arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system
submitted
03/06/2024, 12:39

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

fuck_you.bat
Size

1KB
MD5

11ef3f0b501abd27a91fd9943ae624c2
SHA1

776e0edd83d172c47b644d8be2ee9ef99c9c76de
SHA256

8dbbd25935e2afbb8ec24997b1035783748f6581aee0afb913aa91b607d106db
SHA512

d3dbf073b7f92ee03d64470f251a8e3c4439a807bca8aa9f5a88ab76fbb24d030fb9dcbef8d19762353e106fb715cb964d6d4baa108f86a22c4402ccf38248bf

Score

1^/10

Malware Config

Signatures

Suspicious use of WriteProcessMemory 2 IoCs

description	pid	Process	procid_target
PID 3460 wrote to memory of 3848	3460	cmd.exe	83
PID 3460 wrote to memory of 3848	3460	cmd.exe	83

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\fuck_you.bat"
1⤵
- Suspicious use of WriteProcessMemory
PID:3460
- C:\Windows\system32\cscript.exe
  cscript //nologo prompt.vbs
  2⤵
  PID:3848

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:3544

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalService -p -s fdPHost
1⤵
PID:1268

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads