6d743e476e1408e99415d767b32266a434df12cc583ceb0be5d13398d017782c | Triage

Analysis

max time kernel
1795s
max time network
1799s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
01-07-2024 04:37

Sharing

Report Analysis Logs

General

Target

ne.bat
Size

2KB
MD5

8cb6c4603964edc39539d98d9c88da99
SHA1

b01d7ba59b87b99709fbff1c9c3af21eec69b745
SHA256

6d743e476e1408e99415d767b32266a434df12cc583ceb0be5d13398d017782c
SHA512

3d38048eb181c63a3d563fb96fe8f9f37895389c27ebcd49cc0cd563bcdb0376428eb22969fc61c860a5af8cad808f25e522c32ac643c91be03b26cc0dc10de6

Score

1^/10

Malware Config

Signatures

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1196 wrote to memory of 2216	1196	cmd.exe	91
PID 1196 wrote to memory of 2216	1196	cmd.exe	91
PID 4472 wrote to memory of 3740	4472	cmd.exe	110
PID 4472 wrote to memory of 3740	4472	cmd.exe	110

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\ne.bat"
1⤵
- Suspicious use of WriteProcessMemory
PID:1196
- C:\Windows\system32\chcp.com
  chcp 65001
  2⤵
  PID:2216

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --field-trial-handle=4204,i,10373433614523925616,13586256558317053467,262144 --variations-seed-version --mojo-platform-channel-handle=4004 /prefetch:8
1⤵
PID:3248

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:1968

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\Desktop\ne.bat" "
1⤵
- Suspicious use of WriteProcessMemory
PID:4472
- C:\Windows\system32\chcp.com
  chcp 65001
  2⤵
  PID:3740

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --field-trial-handle=3992,i,10373433614523925616,13586256558317053467,262144 --variations-seed-version --mojo-platform-channel-handle=2132 /prefetch:8
1⤵
PID:4480

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads