b0ed771e6f1fad2f9bd04fa5a749131149e9116dd7c99becc04c23391b9ff690 | Triage™

Analysis

max time kernel
132s
max time network
101s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
03/06/2024, 14:58

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
DesignBuilder.v2.2.4.001-RECOiL/crack/License_Server/service_remove.cmd
Size 727B
Sample240603-scgfgsbd99
SHA256 226204102fd09c3b4e48c7ce0b80ead9bf663b8bf99fd9ead1e143ae9d0a5eea
MD5 ff652ab519f56afb79360b26dd2b5bcc
SHA1 19a5cd845d370efe63101243e91917addf181cb5
SHA512 81c79ca3c7aeff7b0549f7d2701b7d0dda0e4cc59b850cd3d0fc803be87854c427c524d6e283f6668aa645d155c501d7b8d28f4955a9c0d4afe3d7c4f2e5a35a
MD5 SHA1 SHA512

Score

4^/10

Malware Config

Signatures

Launches sc.exe 1 IoCs

Sc.exe is a Windows utlilty to control services on the system.

pid	Process
5084	sc.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 4228 wrote to memory of 5084	4228	cmd.exe	85
PID 4228 wrote to memory of 5084	4228	cmd.exe	85
PID 4228 wrote to memory of 2524	4228	cmd.exe	86
PID 4228 wrote to memory of 2524	4228	cmd.exe	86

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\DesignBuilder.v2.2.4.001-RECOiL\crack\License_Server\service_remove.cmd"
1⤵
- Suspicious use of WriteProcessMemory
PID:4228
- C:\Windows\system32\sc.exe
  sc query type= service state= all
  2⤵
  - Launches sc.exe
  PID:5084
- C:\Windows\system32\find.exe
  find "SERVICE_NAME: DesignBuilder License Server"
  2⤵
  PID:2524

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads