40944a0508c93b43ee7184700dfc4a6760c66db32bf81d66c2941923fd334f6a | Triage

Analysis

max time kernel
147s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
13/06/2024, 01:37

Sharing

Report Analysis Logs

General

Target

BIOS_v1.07/SNIPE.bat
Size

1KB
MD5

53fab8a4de1553b1c6733fbb29d5f0f0
SHA1

b6814ef7cbcee88978278e0aea80e19853048679
SHA256

d60814aba5ce5bc5e0f3b3e59c16266485fb3bd1313ef9d93f39c4f5802127c6
SHA512

b4aaf5a83f7661710bfb3e1c2630345b82bf7751508b3cda52964a99f7f658141979591325814922c8da265e6c4452cc204cb6213229f889ede92bfed6e7d6ce

Score

3^/10

Malware Config

Signatures

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2320	2692	WerFault.exe	81

Suspicious behavior: LoadsDriver 2 IoCs

pid	Process
660	Process not Found
660	Process not Found

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 1244 wrote to memory of 2692	1244	cmd.exe	81
PID 1244 wrote to memory of 2692	1244	cmd.exe	81
PID 1244 wrote to memory of 2692	1244	cmd.exe	81

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\BIOS_v1.07\SNIPE.bat"
1⤵
- Suspicious use of WriteProcessMemory
PID:1244
- C:\Users\Admin\AppData\Local\Temp\BIOS_v1.07\snpac.exe
  snpac
  2⤵
  PID:2692
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 2692 -s 324
    3⤵
    - Program crash
    PID:2320

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 444 -p 2692 -ip 2692
1⤵
PID:828

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads