Analysis
-
max time kernel
51s -
max time network
52s -
platform
windows10-2004_x64 -
resource
win10v2004-20240508-fr -
resource tags
arch:x64arch:x86image:win10v2004-20240508-frlocale:fr-fros:windows10-2004-x64systemwindows -
submitted
11-06-2024 18:10
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
UNLOCKER V2.exe
Resource
win10v2004-20240426-fr
windows10-2004-x64
3 signatures
150 seconds
Behavioral task
behavioral2
Sample
bsod fix.bat
Resource
win10v2004-20240508-fr
windows10-2004-x64
2 signatures
150 seconds
Behavioral task
behavioral3
Sample
w11 fix.bat
Resource
win10v2004-20240508-fr
windows10-2004-x64
10 signatures
150 seconds
General
-
Target
bsod fix.bat
-
Size
415B
-
MD5
392f331dc1744fbe560a2a17d7ca838f
-
SHA1
817559945e137d036f47b26696d4fab5f22572c1
-
SHA256
318ae14fd3712848ed06c109d36a9df600964e1d827581f980c121d52a7b5df5
-
SHA512
0b1023402d8bf343cdee0e1e643209a65879dca4a7e22862b28ba08dea2d1a72ff651ab757ce32ad11add2aad61b44f36a64d1c754bdbe1ea740c44c2857c0dd
Score
1/10
Malware Config
Signatures
-
Runs net.exe
-
Suspicious use of WriteProcessMemory 8 IoCs
Processes:
cmd.exenet.exedescription pid process target process PID 3168 wrote to memory of 4176 3168 cmd.exe net.exe PID 3168 wrote to memory of 4176 3168 cmd.exe net.exe PID 4176 wrote to memory of 3860 4176 net.exe net1.exe PID 4176 wrote to memory of 3860 4176 net.exe net1.exe PID 3168 wrote to memory of 5008 3168 cmd.exe reg.exe PID 3168 wrote to memory of 5008 3168 cmd.exe reg.exe PID 3168 wrote to memory of 3692 3168 cmd.exe reg.exe PID 3168 wrote to memory of 3692 3168 cmd.exe reg.exe
Processes
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\bsod fix.bat"1⤵
- Suspicious use of WriteProcessMemory
PID:3168 -
C:\Windows\system32\net.exeNET SESSION2⤵
- Suspicious use of WriteProcessMemory
PID:4176 -
C:\Windows\system32\net1.exeC:\Windows\system32\net1 SESSION3⤵PID:3860
-
C:\Windows\system32\reg.exereg add "HKLM\SYSTEM\CurrentControlSet\Control\Session Manager\Memory Management" /v FeatureSettingsOverride /t REG_DWORD /d 32⤵PID:5008
-
C:\Windows\system32\reg.exereg add "HKLM\SYSTEM\CurrentControlSet\Control\Session Manager\Memory Management" /v FeatureSettingsOverrideMask /t REG_DWORD /d 32⤵PID:3692