b8a1e46ef14be22cfa81ffe3ed1ed5bbcb7b976d0ddaae57e842123699ac7bfe | Triage

Analysis

max time kernel
51s
max time network
54s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
30/06/2024, 08:48

Sharing

Report Analysis Logs

General

Target

pluto/files/psexec.bat
Size

3KB
MD5

669c176c6ab42f63d8b7cdf40ff652d2
SHA1

ab9d8ab345d09e50de0d58afdf73efc77647701a
SHA256

ba56670c8f09a2523816b154482b26cb2bc5faf496042b0146d7c5a1c977afce
SHA512

2e9a0aeb19a85539f857831fe5a4b6b28621dba4a6b98acdc1e079540a1f7aa3e652ef74334ef36c19bb10bed9fc58a97febcd4eeeaf45e220262be169f57e98

Score

1^/10

Malware Config

Signatures

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1476 wrote to memory of 4028	1476	cmd.exe	81
PID 1476 wrote to memory of 4028	1476	cmd.exe	81
PID 1476 wrote to memory of 4000	1476	cmd.exe	82
PID 1476 wrote to memory of 4000	1476	cmd.exe	82

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\pluto\files\psexec.bat"
1⤵
- Suspicious use of WriteProcessMemory
PID:1476
- C:\Windows\system32\mode.com
  mode 100, 30
  2⤵
  PID:4028
- C:\Windows\system32\chcp.com
  chcp 65001
  2⤵
  PID:4000

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads