b0ed771e6f1fad2f9bd04fa5a749131149e9116dd7c99becc04c23391b9ff690 | Triage™

Analysis

max time kernel
121s
max time network
122s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
03/06/2024, 14:58

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
DesignBuilder.v2.2.4.001-RECOiL/crack/License_Server/service_remove.cmd
Size 727B
Sample240603-scgfgsbd99
SHA256 226204102fd09c3b4e48c7ce0b80ead9bf663b8bf99fd9ead1e143ae9d0a5eea
MD5 ff652ab519f56afb79360b26dd2b5bcc
SHA1 19a5cd845d370efe63101243e91917addf181cb5
SHA512 81c79ca3c7aeff7b0549f7d2701b7d0dda0e4cc59b850cd3d0fc803be87854c427c524d6e283f6668aa645d155c501d7b8d28f4955a9c0d4afe3d7c4f2e5a35a
MD5 SHA1 SHA512

Score

4^/10

Malware Config

Signatures

Launches sc.exe 1 IoCs

Sc.exe is a Windows utlilty to control services on the system.

pid	Process
1764	sc.exe

Suspicious use of WriteProcessMemory 6 IoCs

description	pid	Process	procid_target
PID 856 wrote to memory of 1764	856	cmd.exe	29
PID 856 wrote to memory of 1764	856	cmd.exe	29
PID 856 wrote to memory of 1764	856	cmd.exe	29
PID 856 wrote to memory of 2368	856	cmd.exe	30
PID 856 wrote to memory of 2368	856	cmd.exe	30
PID 856 wrote to memory of 2368	856	cmd.exe	30

C:\Windows\system32\cmd.exe
cmd /c "C:\Users\Admin\AppData\Local\Temp\DesignBuilder.v2.2.4.001-RECOiL\crack\License_Server\service_remove.cmd"
1⤵
- Suspicious use of WriteProcessMemory
PID:856
- C:\Windows\system32\sc.exe
  sc query type= service state= all
  2⤵
  - Launches sc.exe
  PID:1764
- C:\Windows\system32\find.exe
  find "SERVICE_NAME: DesignBuilder License Server"
  2⤵
  PID:2368

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads