ff8c11f132ed73ea6cbdf3dae4f8d02886392d66c1adfef3ad52f5a1f5022cb5

Analysis

max time kernel
143s
max time network
148s
platform
windows10-2004_x64
resource
win10v2004-20240611-en
resource tags

arch:x64arch:x86image:win10v2004-20240611-enlocale:en-usos:windows10-2004-x64system
submitted
19/06/2024, 15:18

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

Command Line Examples.cmd
Size

379B
MD5

ea34aeffb40b76122edec5f028441bc4
SHA1

72e9642ed07f2941e590af9634c740a7073b559d
SHA256

b6f7616f406f074dc9e75f28df169444f370ba6605bbcff97a165dd799f29126
SHA512

009f1c32511a4410ae33a1782a917137bd893d99daa3c6f32b3b7dbf1c30d29eea56b2dd3bb1709292670d317459e514501bd41b8c3334498d16fe21334add91

Score

1^/10

Malware Config

Signatures

Suspicious use of SetWindowsHookEx 3 IoCs

pid	Process
4128	3dRipperPro.exe
2828	3dRipperPro.exe
2808	3dRipperPro.exe

Suspicious use of WriteProcessMemory 15 IoCs

description	pid	Process	procid_target
PID 452 wrote to memory of 4128	452	cmd.exe	92
PID 452 wrote to memory of 4128	452	cmd.exe	92
PID 452 wrote to memory of 4128	452	cmd.exe	92
PID 4128 wrote to memory of 3096	4128	3dRipperPro.exe	101
PID 4128 wrote to memory of 3096	4128	3dRipperPro.exe	101
PID 452 wrote to memory of 2828	452	cmd.exe	102
PID 452 wrote to memory of 2828	452	cmd.exe	102
PID 452 wrote to memory of 2828	452	cmd.exe	102
PID 2828 wrote to memory of 3128	2828	3dRipperPro.exe	113
PID 2828 wrote to memory of 3128	2828	3dRipperPro.exe	113
PID 452 wrote to memory of 2808	452	cmd.exe	115
PID 452 wrote to memory of 2808	452	cmd.exe	115
PID 452 wrote to memory of 2808	452	cmd.exe	115
PID 2808 wrote to memory of 1228	2808	3dRipperPro.exe	116
PID 2808 wrote to memory of 1228	2808	3dRipperPro.exe	116

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\Command Line Examples.cmd"
1⤵
- Suspicious use of WriteProcessMemory
PID:452
- C:\Users\Admin\AppData\Local\Temp\3dRipperPro.exe
  3dRipperPro.exe 347cae9f87104374bc3ac554d9d3fd6e
  2⤵
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:4128
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://3dripper.com/
    3⤵
    PID:3096
- C:\Users\Admin\AppData\Local\Temp\3dRipperPro.exe
  3dRipperPro.exe 450fb6a057fd4ce4a416c714a5676fdf textures
  2⤵
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:2828
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://3dripper.com/
    3⤵
    PID:3128
- C:\Users\Admin\AppData\Local\Temp\3dRipperPro.exe
  3dRipperPro.exe 450fb6a057fd4ce4a416c714a5676fdf batch
  2⤵
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:2808
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://3dripper.com/
    3⤵
    PID:1228

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --field-trial-handle=3772,i,1305347165619645738,15927664461101562802,262144 --variations-seed-version --mojo-platform-channel-handle=4236 /prefetch:8
1⤵
PID:1600

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=17 --field-trial-handle=4732,i,1305347165619645738,15927664461101562802,262144 --variations-seed-version --mojo-platform-channel-handle=5012 /prefetch:1
1⤵
PID:1988

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=16 --field-trial-handle=3940,i,1305347165619645738,15927664461101562802,262144 --variations-seed-version --mojo-platform-channel-handle=5036 /prefetch:1
1⤵
PID:2528

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=18 --field-trial-handle=5432,i,1305347165619645738,15927664461101562802,262144 --variations-seed-version --mojo-platform-channel-handle=5460 /prefetch:1
1⤵
PID:2388

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --field-trial-handle=5592,i,1305347165619645738,15927664461101562802,262144 --variations-seed-version --mojo-platform-channel-handle=5620 /prefetch:8
1⤵
PID:5116

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --disable-gpu-compositing --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=20 --field-trial-handle=5920,i,1305347165619645738,15927664461101562802,262144 --variations-seed-version --mojo-platform-channel-handle=5944 /prefetch:1
1⤵
PID:2672

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --lang=en-US --service-sandbox-type=audio --field-trial-handle=5044,i,1305347165619645738,15927664461101562802,262144 --variations-seed-version --mojo-platform-channel-handle=4996 /prefetch:8
1⤵
PID:4112

C:\Windows\system32\AUDIODG.EXE
C:\Windows\system32\AUDIODG.EXE 0x404 0x320
1⤵
PID:2804

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --field-trial-handle=5032,i,1305347165619645738,15927664461101562802,262144 --variations-seed-version --mojo-platform-channel-handle=6156 /prefetch:8
1⤵
PID:3688

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --disable-gpu-compositing --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=23 --field-trial-handle=6400,i,1305347165619645738,15927664461101562802,262144 --variations-seed-version --mojo-platform-channel-handle=6484 /prefetch:1
1⤵
PID:1596

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --disable-gpu-compositing --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=24 --field-trial-handle=6776,i,1305347165619645738,15927664461101562802,262144 --variations-seed-version --mojo-platform-channel-handle=6864 /prefetch:1
1⤵
PID:1692

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --field-trial-handle=6952,i,1305347165619645738,15927664461101562802,262144 --variations-seed-version --mojo-platform-channel-handle=6992 /prefetch:8
1⤵
PID:2192

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\temp.dat

Filesize
77B

MD5
1353a80c4e6dbb0c8a6c00971986a69a

SHA1
94db0fb235b195321068d128274102c4355c9b7f

SHA256
37b419c6824914df20a2df85866f60cb34d36c03d9d86b3f8850bbf6f2a221c8

SHA512
14ea3831e38d9238eccbbb7f3720a67f40bf7658bc47641fe21f7b7739fcf94d7b316c871b87aa086692cab47c3f9461cfdebf8a3b90e1f714753d9551179ce0

Download Submit
C:\Users\Admin\AppData\Local\Temp\temp.dat

Filesize
14B

MD5
92192005327a2acf6d987dc8e7d2495a

SHA1
f40a34752e490997ac9c4517c24cba7f66c42af6

SHA256
c836b5b4464d311f260bd2317e0feb3b47bcab3d245f0b9a2c00f0fac921c699

SHA512
b29b608364f267596a62bdec7271b3dd9e35e33ddff5b56873fe32345296e1034bbb9702986a9c75698bfe3d5abefb70b130e3419303977c95f998092edd7132

Download Submit

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads