63c4bb88c34923db9788828192dade8d7850736d9a681c3dc9f6a90ae05c2d3f

Resubmissions

15/06/2024, 16:17

240615-trpk3szhrk 1

15/06/2024, 16:14

240615-tpvpbawgre 1

15/06/2024, 16:11

240615-tmyceswgmc 3

15/06/2024, 16:07

240615-tk2l3awfrh 1

Analysis

max time kernel
16s
max time network
19s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
15/06/2024, 16:17

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

Ghost.bat
Size

28B
MD5

0aea348c791992cc0a5124925ebcb4f5
SHA1

cd2c331b3f72c8a681b76f59dfe09b825f36caf4
SHA256

63c4bb88c34923db9788828192dade8d7850736d9a681c3dc9f6a90ae05c2d3f
SHA512

bb08ce72a106e1cbc90b148a64826f0a9c502197f1fe0cbc250eb7f5e0b7f118d964fadcf44e2d408f584343a417890a75d8813662006f265a816ce793bad64e

Score

1^/10

Malware Config

Signatures

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 3844 wrote to memory of 996	3844	cmd.exe	95
PID 3844 wrote to memory of 996	3844	cmd.exe	95
PID 3844 wrote to memory of 2320	3844	cmd.exe	97
PID 3844 wrote to memory of 2320	3844	cmd.exe	97
PID 3844 wrote to memory of 1036	3844	cmd.exe	99
PID 3844 wrote to memory of 1036	3844	cmd.exe	99
PID 3844 wrote to memory of 948	3844	cmd.exe	101
PID 3844 wrote to memory of 948	3844	cmd.exe	101
PID 3844 wrote to memory of 2288	3844	cmd.exe	102
PID 3844 wrote to memory of 2288	3844	cmd.exe	102
PID 3844 wrote to memory of 2488	3844	cmd.exe	103
PID 3844 wrote to memory of 2488	3844	cmd.exe	103
PID 3844 wrote to memory of 4080	3844	cmd.exe	104
PID 3844 wrote to memory of 4080	3844	cmd.exe	104
PID 3844 wrote to memory of 656	3844	cmd.exe	105
PID 3844 wrote to memory of 656	3844	cmd.exe	105
PID 3844 wrote to memory of 4344	3844	cmd.exe	106
PID 3844 wrote to memory of 4344	3844	cmd.exe	106
PID 3844 wrote to memory of 2092	3844	cmd.exe	113
PID 3844 wrote to memory of 2092	3844	cmd.exe	113
PID 3844 wrote to memory of 1468	3844	cmd.exe	115
PID 3844 wrote to memory of 1468	3844	cmd.exe	115
PID 3844 wrote to memory of 3472	3844	cmd.exe	117
PID 3844 wrote to memory of 3472	3844	cmd.exe	117
PID 3844 wrote to memory of 3092	3844	cmd.exe	118
PID 3844 wrote to memory of 3092	3844	cmd.exe	118
PID 3844 wrote to memory of 672	3844	cmd.exe	120
PID 3844 wrote to memory of 672	3844	cmd.exe	120
PID 3844 wrote to memory of 4692	3844	cmd.exe	123
PID 3844 wrote to memory of 4692	3844	cmd.exe	123
PID 3844 wrote to memory of 4672	3844	cmd.exe	125
PID 3844 wrote to memory of 4672	3844	cmd.exe	125
PID 3844 wrote to memory of 3132	3844	cmd.exe	128
PID 3844 wrote to memory of 3132	3844	cmd.exe	128
PID 3844 wrote to memory of 4340	3844	cmd.exe	131
PID 3844 wrote to memory of 4340	3844	cmd.exe	131
PID 3844 wrote to memory of 3796	3844	cmd.exe	133
PID 3844 wrote to memory of 3796	3844	cmd.exe	133
PID 3844 wrote to memory of 4288	3844	cmd.exe	134
PID 3844 wrote to memory of 4288	3844	cmd.exe	134
PID 3844 wrote to memory of 4304	3844	cmd.exe	135
PID 3844 wrote to memory of 4304	3844	cmd.exe	135
PID 3844 wrote to memory of 4232	3844	cmd.exe	139
PID 3844 wrote to memory of 4232	3844	cmd.exe	139
PID 3844 wrote to memory of 676	3844	cmd.exe	140
PID 3844 wrote to memory of 676	3844	cmd.exe	140
PID 3844 wrote to memory of 1492	3844	cmd.exe	143
PID 3844 wrote to memory of 1492	3844	cmd.exe	143
PID 3844 wrote to memory of 5124	3844	cmd.exe	144
PID 3844 wrote to memory of 5124	3844	cmd.exe	144
PID 3844 wrote to memory of 5132	3844	cmd.exe	145
PID 3844 wrote to memory of 5132	3844	cmd.exe	145
PID 3844 wrote to memory of 5304	3844	cmd.exe	149
PID 3844 wrote to memory of 5304	3844	cmd.exe	149
PID 3844 wrote to memory of 5460	3844	cmd.exe	151
PID 3844 wrote to memory of 5460	3844	cmd.exe	151
PID 3844 wrote to memory of 5544	3844	cmd.exe	153
PID 3844 wrote to memory of 5544	3844	cmd.exe	153
PID 3844 wrote to memory of 5568	3844	cmd.exe	155
PID 3844 wrote to memory of 5568	3844	cmd.exe	155
PID 3844 wrote to memory of 5576	3844	cmd.exe	156
PID 3844 wrote to memory of 5576	3844	cmd.exe	156
PID 3844 wrote to memory of 5600	3844	cmd.exe	158
PID 3844 wrote to memory of 5600	3844	cmd.exe	158

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\Ghost.bat"
1⤵
- Suspicious use of WriteProcessMemory
PID:3844
- C:\Windows\system32\cmd.exe
  cmd.exe
  2⤵
  PID:996
- C:\Windows\system32\cmd.exe
  cmd.exe
  2⤵
  PID:2320
- C:\Windows\system32\cmd.exe
  cmd.exe
  2⤵
  PID:1036
- C:\Windows\system32\cmd.exe
  cmd.exe
  2⤵
  PID:948
- C:\Windows\system32\cmd.exe
  cmd.exe
  2⤵
  PID:2288
- C:\Windows\system32\cmd.exe
  cmd.exe
  2⤵
  PID:2488
- C:\Windows\system32\cmd.exe
  cmd.exe
  2⤵
  PID:4080
- C:\Windows\system32\cmd.exe
  cmd.exe
  2⤵
  PID:656
- C:\Windows\system32\cmd.exe
  cmd.exe
  2⤵
  PID:4344
- C:\Windows\system32\cmd.exe
  cmd.exe
  2⤵
  PID:2092
- C:\Windows\system32\cmd.exe
  cmd.exe
  2⤵
  PID:1468
- C:\Windows\system32\cmd.exe
  cmd.exe
  2⤵
  PID:3472
- C:\Windows\system32\cmd.exe
  cmd.exe
  2⤵
  PID:3092
- C:\Windows\system32\cmd.exe
  cmd.exe
  2⤵
  PID:672
- C:\Windows\system32\cmd.exe
  cmd.exe
  2⤵
  PID:4692
- C:\Windows\system32\cmd.exe
  cmd.exe
  2⤵
  PID:4672
- C:\Windows\system32\cmd.exe
  cmd.exe
  2⤵
  PID:3132
- C:\Windows\system32\cmd.exe
  cmd.exe
  2⤵
  PID:4340
- C:\Windows\system32\cmd.exe
  cmd.exe
  2⤵
  PID:3796
- C:\Windows\system32\cmd.exe
  cmd.exe
  2⤵
  PID:4288
- C:\Windows\system32\cmd.exe
  cmd.exe
  2⤵
  PID:4304
- C:\Windows\system32\cmd.exe
  cmd.exe
  2⤵
  PID:4232
- C:\Windows\system32\cmd.exe
  cmd.exe
  2⤵
  PID:676
- C:\Windows\system32\cmd.exe
  cmd.exe
  2⤵
  PID:1492
- C:\Windows\system32\cmd.exe
  cmd.exe
  2⤵
  PID:5124
- C:\Windows\system32\cmd.exe
  cmd.exe
  2⤵
  PID:5132
- C:\Windows\system32\cmd.exe
  cmd.exe
  2⤵
  PID:5304
- C:\Windows\system32\cmd.exe
  cmd.exe
  2⤵
  PID:5460
- C:\Windows\system32\cmd.exe
  cmd.exe
  2⤵
  PID:5544
- C:\Windows\system32\cmd.exe
  cmd.exe
  2⤵
  PID:5568
- C:\Windows\system32\cmd.exe
  cmd.exe
  2⤵
  PID:5576
- C:\Windows\system32\cmd.exe
  cmd.exe
  2⤵
  PID:5600
- C:\Windows\system32\cmd.exe
  cmd.exe
  2⤵
  PID:5640
- C:\Windows\system32\cmd.exe
  cmd.exe
  2⤵
  PID:5656
- C:\Windows\system32\cmd.exe
  cmd.exe
  2⤵
  PID:5664
- C:\Windows\system32\cmd.exe
  cmd.exe
  2⤵
  PID:5696
- C:\Windows\system32\cmd.exe
  cmd.exe
  2⤵
  PID:5704
- C:\Windows\system32\cmd.exe
  cmd.exe
  2⤵
  PID:5712
- C:\Windows\system32\cmd.exe
  cmd.exe
  2⤵
  PID:5720
- C:\Windows\system32\cmd.exe
  cmd.exe
  2⤵
  PID:5784
- C:\Windows\system32\cmd.exe
  cmd.exe
  2⤵
  PID:5996
- C:\Windows\system32\cmd.exe
  cmd.exe
  2⤵
  PID:6012
- C:\Windows\system32\cmd.exe
  cmd.exe
  2⤵
  PID:6020
- C:\Windows\system32\cmd.exe
  cmd.exe
  2⤵
  PID:6028
- C:\Windows\system32\cmd.exe
  cmd.exe
  2⤵
  PID:6036
- C:\Windows\system32\cmd.exe
  cmd.exe
  2⤵
  PID:6044
- C:\Windows\system32\cmd.exe
  cmd.exe
  2⤵
  PID:5808
- C:\Windows\system32\cmd.exe
  cmd.exe
  2⤵
  PID:6272
- C:\Windows\system32\cmd.exe
  cmd.exe
  2⤵
  PID:6280

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --field-trial-handle=4160,i,4356837537417149674,16553092232944545509,262144 --variations-seed-version --mojo-platform-channel-handle=1036 /prefetch:8
1⤵
PID:6676

Windows 7 deprecation

Loading Replay Monitor...

Resubmissions

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads