35ce9a93d911373f6e392d3608413d0f95c6c3b6c0d3b582dbf718211b024241 | Triage

Analysis

max time kernel
49s
max time network
56s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
18-06-2024 08:10

Sharing

Report Analysis Logs

General

Target

bsod fix.bat
Size

415B
MD5

392f331dc1744fbe560a2a17d7ca838f
SHA1

817559945e137d036f47b26696d4fab5f22572c1
SHA256

318ae14fd3712848ed06c109d36a9df600964e1d827581f980c121d52a7b5df5
SHA512

0b1023402d8bf343cdee0e1e643209a65879dca4a7e22862b28ba08dea2d1a72ff651ab757ce32ad11add2aad61b44f36a64d1c754bdbe1ea740c44c2857c0dd

Score

1^/10

Malware Config

Signatures

Runs net.exe

Suspicious use of WriteProcessMemory 8 IoCs

Processes:

cmd.exenet.exe

description	pid	process	target process
PID 3452 wrote to memory of 1612	3452	cmd.exe	net.exe
PID 3452 wrote to memory of 1612	3452	cmd.exe	net.exe
PID 1612 wrote to memory of 3600	1612	net.exe	net1.exe
PID 1612 wrote to memory of 3600	1612	net.exe	net1.exe
PID 3452 wrote to memory of 2596	3452	cmd.exe	reg.exe
PID 3452 wrote to memory of 2596	3452	cmd.exe	reg.exe
PID 3452 wrote to memory of 4748	3452	cmd.exe	reg.exe
PID 3452 wrote to memory of 4748	3452	cmd.exe	reg.exe

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\bsod fix.bat"
1⤵
- Suspicious use of WriteProcessMemory
PID:3452

C:\Windows\system32\net.exe
NET SESSION
2⤵
- Suspicious use of WriteProcessMemory
PID:1612

C:\Windows\system32\net1.exe
C:\Windows\system32\net1 SESSION
3⤵
PID:3600

C:\Windows\system32\reg.exe
reg add "HKLM\SYSTEM\CurrentControlSet\Control\Session Manager\Memory Management" /v FeatureSettingsOverride /t REG_DWORD /d 3
2⤵
PID:2596

C:\Windows\system32\reg.exe
reg add "HKLM\SYSTEM\CurrentControlSet\Control\Session Manager\Memory Management" /v FeatureSettingsOverrideMask /t REG_DWORD /d 3
2⤵
PID:4748

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=1416 --field-trial-handle=3240,i,13319578961094268484,16557498665191861597,262144 --variations-seed-version /prefetch:8
1⤵
PID:1000

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads