23873dba0e67fba174146cc0dfe7c73faf44315447ccb7ce39e3e4eb7a7bc812

General

Target

dropper_1.bat
Size

4KB
MD5

79ed3c44fbaa266a61ab8764d2c3b520
SHA1

277d14837b49e11dee8fbfbe3542b895553d20e2
SHA256

23873dba0e67fba174146cc0dfe7c73faf44315447ccb7ce39e3e4eb7a7bc812
SHA512

feeb1263aa99115ab4b96752ec97bc30c1e73f8c0adc206dee918f656c34d81ee61d391357895453c1266476cb91223e125e5b4b01aabf28580e00120ab32ea4
SSDEEP

48:61jKP/WlIqQ9+iCObFg/7gGcK+hrZahJUrSXYSlDI6p8536anO6jiF6ydr6o3Sqk:ZP/HVbxaLUrCcKoig

Score

3^/10

Malware Config

Signatures

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082
Delays execution with timeout.exe 1 IoCs
evasion

Processes:

timeout.exe

pid process

1156 timeout.exe

pid	process
1156	timeout.exe

Suspicious use of WriteProcessMemory 64 IoCs

Processes:

cmd.exe

description	pid	process	target process
PID 2180 wrote to memory of 2572	2180	cmd.exe	chcp.com
PID 2180 wrote to memory of 2572	2180	cmd.exe	chcp.com
PID 2180 wrote to memory of 2572	2180	cmd.exe	chcp.com
PID 2180 wrote to memory of 2360	2180	cmd.exe	cmd.exe
PID 2180 wrote to memory of 2360	2180	cmd.exe	cmd.exe
PID 2180 wrote to memory of 2360	2180	cmd.exe	cmd.exe
PID 2180 wrote to memory of 2792	2180	cmd.exe	reg.exe
PID 2180 wrote to memory of 2792	2180	cmd.exe	reg.exe
PID 2180 wrote to memory of 2792	2180	cmd.exe	reg.exe
PID 2180 wrote to memory of 1936	2180	cmd.exe	cmd.exe
PID 2180 wrote to memory of 1936	2180	cmd.exe	cmd.exe
PID 2180 wrote to memory of 1936	2180	cmd.exe	cmd.exe
PID 2180 wrote to memory of 1036	2180	cmd.exe	reg.exe
PID 2180 wrote to memory of 1036	2180	cmd.exe	reg.exe
PID 2180 wrote to memory of 1036	2180	cmd.exe	reg.exe
PID 2180 wrote to memory of 2676	2180	cmd.exe	cmd.exe
PID 2180 wrote to memory of 2676	2180	cmd.exe	cmd.exe
PID 2180 wrote to memory of 2676	2180	cmd.exe	cmd.exe
PID 2180 wrote to memory of 2168	2180	cmd.exe	reg.exe
PID 2180 wrote to memory of 2168	2180	cmd.exe	reg.exe
PID 2180 wrote to memory of 2168	2180	cmd.exe	reg.exe
PID 2180 wrote to memory of 2580	2180	cmd.exe	cmd.exe
PID 2180 wrote to memory of 2580	2180	cmd.exe	cmd.exe
PID 2180 wrote to memory of 2580	2180	cmd.exe	cmd.exe
PID 2180 wrote to memory of 2352	2180	cmd.exe	reg.exe
PID 2180 wrote to memory of 2352	2180	cmd.exe	reg.exe
PID 2180 wrote to memory of 2352	2180	cmd.exe	reg.exe
PID 2180 wrote to memory of 1248	2180	cmd.exe	cmd.exe
PID 2180 wrote to memory of 1248	2180	cmd.exe	cmd.exe
PID 2180 wrote to memory of 1248	2180	cmd.exe	cmd.exe
PID 2180 wrote to memory of 2592	2180	cmd.exe	reg.exe
PID 2180 wrote to memory of 2592	2180	cmd.exe	reg.exe
PID 2180 wrote to memory of 2592	2180	cmd.exe	reg.exe
PID 2180 wrote to memory of 2260	2180	cmd.exe	cmd.exe
PID 2180 wrote to memory of 2260	2180	cmd.exe	cmd.exe
PID 2180 wrote to memory of 2260	2180	cmd.exe	cmd.exe
PID 2180 wrote to memory of 2616	2180	cmd.exe	reg.exe
PID 2180 wrote to memory of 2616	2180	cmd.exe	reg.exe
PID 2180 wrote to memory of 2616	2180	cmd.exe	reg.exe
PID 2180 wrote to memory of 2644	2180	cmd.exe	cmd.exe
PID 2180 wrote to memory of 2644	2180	cmd.exe	cmd.exe
PID 2180 wrote to memory of 2644	2180	cmd.exe	cmd.exe
PID 2180 wrote to memory of 2744	2180	cmd.exe	reg.exe
PID 2180 wrote to memory of 2744	2180	cmd.exe	reg.exe
PID 2180 wrote to memory of 2744	2180	cmd.exe	reg.exe
PID 2180 wrote to memory of 2748	2180	cmd.exe	cmd.exe
PID 2180 wrote to memory of 2748	2180	cmd.exe	cmd.exe
PID 2180 wrote to memory of 2748	2180	cmd.exe	cmd.exe
PID 2180 wrote to memory of 2776	2180	cmd.exe	reg.exe
PID 2180 wrote to memory of 2776	2180	cmd.exe	reg.exe
PID 2180 wrote to memory of 2776	2180	cmd.exe	reg.exe
PID 2180 wrote to memory of 2892	2180	cmd.exe	cmd.exe
PID 2180 wrote to memory of 2892	2180	cmd.exe	cmd.exe
PID 2180 wrote to memory of 2892	2180	cmd.exe	cmd.exe
PID 2180 wrote to memory of 2976	2180	cmd.exe	reg.exe
PID 2180 wrote to memory of 2976	2180	cmd.exe	reg.exe
PID 2180 wrote to memory of 2976	2180	cmd.exe	reg.exe
PID 2180 wrote to memory of 2620	2180	cmd.exe	cmd.exe
PID 2180 wrote to memory of 2620	2180	cmd.exe	cmd.exe
PID 2180 wrote to memory of 2620	2180	cmd.exe	cmd.exe
PID 2180 wrote to memory of 2052	2180	cmd.exe	reg.exe
PID 2180 wrote to memory of 2052	2180	cmd.exe	reg.exe
PID 2180 wrote to memory of 2052	2180	cmd.exe	reg.exe
PID 2180 wrote to memory of 2960	2180	cmd.exe	cmd.exe

C:\Windows\system32\cmd.exe
cmd /c "C:\Users\Admin\AppData\Local\Temp\dropper_1.bat"
1⤵
- Suspicious use of WriteProcessMemory
PID:2180

C:\Windows\system32\chcp.com
chcp 65001
2⤵
PID:2572

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /S /D /c" echo y "
2⤵
PID:2360

C:\Windows\system32\reg.exe
C:\Windows\system32\reg add HKEY_LOCAL_MACHINE\SOFTWARE\$77config\paths /v wow /d C:\Windows\Resources\$77-sdchost.exe
2⤵
PID:2792

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /S /D /c" echo y "
2⤵
PID:1936

C:\Windows\system32\reg.exe
C:\Windows\system32\reg add HKEY_LOCAL_MACHINE\SOFTWARE\$77config\process_names /v wow /d $77-sdchost.exe
2⤵
PID:1036

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /S /D /c" echo y "
2⤵
PID:2676

C:\Windows\system32\reg.exe
C:\Windows\system32\reg add HKEY_LOCAL_MACHINE\SOFTWARE\$77config\startup /v wow /d C:\Windows\Resources\$77-sdchost.exe
2⤵
PID:2168

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /S /D /c" echo y "
2⤵
PID:2580

C:\Windows\system32\reg.exe
C:\Windows\system32\reg add HKEY_LOCAL_MACHINE\SOFTWARE\$77config\paths /v wow /d C:\Windows\Resources\$77-scchost.exe
2⤵
PID:2352

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /S /D /c" echo y "
2⤵
PID:1248

C:\Windows\system32\reg.exe
C:\Windows\system32\reg add HKEY_LOCAL_MACHINE\SOFTWARE\$77config\process_names /v wow /d $77-scchost.exe
2⤵
PID:2592

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /S /D /c" echo y "
2⤵
PID:2260

C:\Windows\system32\reg.exe
C:\Windows\system32\reg add HKEY_LOCAL_MACHINE\SOFTWARE\$77config\startup /v wow /d C:\Windows\Resources\$77-scchost.exe
2⤵
PID:2616

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /S /D /c" echo y "
2⤵
PID:2644

C:\Windows\system32\reg.exe
C:\Windows\system32\reg add HKEY_LOCAL_MACHINE\SOFTWARE\$77config\paths /v wow /d C:\Windows\Resources\$77-penisware.exe
2⤵
PID:2744

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /S /D /c" echo y "
2⤵
PID:2748

C:\Windows\system32\reg.exe
C:\Windows\system32\reg add HKEY_LOCAL_MACHINE\SOFTWARE\$77config\process_names /v wow /d $77-penisware.exe
2⤵
PID:2776

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /S /D /c" echo y "
2⤵
PID:2892

C:\Windows\system32\reg.exe
C:\Windows\system32\reg add HKEY_LOCAL_MACHINE\SOFTWARE\$77config\startup /v wow /d C:\Windows\Resources\$77-penisware.exe
2⤵
PID:2976

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /S /D /c" echo y "
2⤵
PID:2620

C:\Windows\system32\reg.exe
C:\Windows\system32\reg add HKEY_LOCAL_MACHINE\SOFTWARE\$77config\paths /v wow /d C:\Windows\Resources\$77-penisware2.exe
2⤵
PID:2052

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /S /D /c" echo y "
2⤵
PID:2960

C:\Windows\system32\reg.exe
C:\Windows\system32\reg add HKEY_LOCAL_MACHINE\SOFTWARE\$77config\process_names /v wow /d $77-penisware2.exe
2⤵
PID:2764

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /S /D /c" echo y "
2⤵
PID:2732

C:\Windows\system32\reg.exe
C:\Windows\system32\reg add HKEY_LOCAL_MACHINE\SOFTWARE\$77config\startup /v wow /d C:\Windows\Resources\$77-penisware2.exe
2⤵
PID:2524

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /S /D /c" echo y "
2⤵
PID:2784

C:\Windows\system32\reg.exe
C:\Windows\system32\reg add HKEY_LOCAL_MACHINE\SOFTWARE\$77config\paths /v wow /d C:\Windows\Resources\$77-install.exe
2⤵
PID:2856

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /S /D /c" echo y "
2⤵
PID:2516

C:\Windows\system32\reg.exe
C:\Windows\system32\reg add HKEY_LOCAL_MACHINE\SOFTWARE\$77config\process_names /v wow /d $77-install.exe
2⤵
PID:2920

C:\Windows\system32\timeout.exe
timeout 2
2⤵
- Delays execution with timeout.exe
PID:1156

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

1

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Resource Development

Reconnaissance

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v13

Replay Monitor

Loading Replay Monitor...

Downloads