40944a0508c93b43ee7184700dfc4a6760c66db32bf81d66c2941923fd334f6a | Triage

Analysis

max time kernel
121s
max time network
123s
platform
windows7_x64
resource
win7-20240611-en
resource tags

arch:x64arch:x86image:win7-20240611-enlocale:en-usos:windows7-x64system
submitted
13/06/2024, 01:37

Sharing

Report Analysis Logs

General

Target

BIOS_v1.07/SNIPE.bat
Size

1KB
MD5

53fab8a4de1553b1c6733fbb29d5f0f0
SHA1

b6814ef7cbcee88978278e0aea80e19853048679
SHA256

d60814aba5ce5bc5e0f3b3e59c16266485fb3bd1313ef9d93f39c4f5802127c6
SHA512

b4aaf5a83f7661710bfb3e1c2630345b82bf7751508b3cda52964a99f7f658141979591325814922c8da265e6c4452cc204cb6213229f889ede92bfed6e7d6ce

Score

3^/10

Malware Config

Signatures

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2604	2004	WerFault.exe	29

Suspicious behavior: CmdExeWriteProcessMemorySpam 1 IoCs

pid	Process
2004	snpac.exe

Suspicious behavior: LoadsDriver 2 IoCs

pid	Process
476	Process not Found
476	Process not Found

Suspicious use of WriteProcessMemory 8 IoCs

description	pid	Process	procid_target
PID 2072 wrote to memory of 2004	2072	cmd.exe	29
PID 2072 wrote to memory of 2004	2072	cmd.exe	29
PID 2072 wrote to memory of 2004	2072	cmd.exe	29
PID 2072 wrote to memory of 2004	2072	cmd.exe	29
PID 2004 wrote to memory of 2604	2004	snpac.exe	30
PID 2004 wrote to memory of 2604	2004	snpac.exe	30
PID 2004 wrote to memory of 2604	2004	snpac.exe	30
PID 2004 wrote to memory of 2604	2004	snpac.exe	30

C:\Windows\system32\cmd.exe
cmd /c "C:\Users\Admin\AppData\Local\Temp\BIOS_v1.07\SNIPE.bat"
1⤵
- Suspicious use of WriteProcessMemory
PID:2072
- C:\Users\Admin\AppData\Local\Temp\BIOS_v1.07\snpac.exe
  snpac
  2⤵
  - Suspicious behavior: CmdExeWriteProcessMemorySpam
  - Suspicious use of WriteProcessMemory
  PID:2004
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 2004 -s 160
    3⤵
    - Program crash
    PID:2604

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads