445bc69abbd0eba7c5c4092561043eb80cde9ce361d970782837431f23460e87

Analysis

max time kernel
66s
max time network
126s
platform
windows11-21h2_x64
resource
win11-20240611-en
resource tags

arch:x64arch:x86image:win11-20240611-enlocale:en-usos:windows11-21h2-x64system
submitted
26/06/2024, 17:38

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
fps boost tweak/2 Cleanup/Delete Temporary Files.cmd
Size 273B
Sample240626-v73cjsvdmc
SHA256 b75c09af165c8e42d780a00142451b6f5745cafab60f0957ca018c17b878a703
MD5 2ffb5f1c8e8e17ee9b40108f82c6bdab
SHA1 47e27a22fcdfb68e9b1f6a460fe6ddc33e9a3a34
SHA512 4410f3a2ca03ca59bd92aa18792d2523c0fe04a033758266090cf140c1e4830d28aba43fd549513f3c81e91e5cc984dbb8da8811e4d8fb9a46df1df1366b8e92
MD5 SHA1 SHA512

Score

7^/10

discovery

Malware Config

Signatures

Modifies file permissions 1 TTPs 1 IoCs

discovery

File and Directory Permissions Modification

T1222

pid	Process
2096	takeown.exe

Suspicious use of WriteProcessMemory 2 IoCs

description	pid	Process	procid_target
PID 5028 wrote to memory of 2096	5028	cmd.exe	82
PID 5028 wrote to memory of 2096	5028	cmd.exe	82

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\fps boost tweak\2 Cleanup\Delete Temporary Files.cmd"
1⤵
- Suspicious use of WriteProcessMemory
PID:5028
- C:\Windows\system32\takeown.exe
  takeown /f "C:\Users\Admin\AppData\Local\Temp" /r /d y
  2⤵
  - Modifies file permissions
  PID:2096

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

File and Directory Permissions Modification

T1222

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads