7693e0c9f20b5f90ebf95bbb807bb605ea0aa92f7fa30e4fd3d3d857db492dba | Triage

Resubmissions

03/07/2024, 05:55

240703-gml8yazgne 1

03/07/2024, 05:52

240703-gkytystgrk 5

Analysis

max time kernel
27s
max time network
16s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
03/07/2024, 05:55

Sharing

Report Analysis Logs

General

Target

voris.bat
Size

1KB
MD5

ad7217bf878a2fa8efdf11016f36070f
SHA1

e49a08f35b9f226bcbea78e1bfbe688d0defc545
SHA256

7693e0c9f20b5f90ebf95bbb807bb605ea0aa92f7fa30e4fd3d3d857db492dba
SHA512

5d9bba18ba248b7fcaba4a5a8426f2bd881cceb241983950086f0e6e06d639d7f8fb32ab45e6635768d774a523f0fcbe66b169070469111ef451d692cdfc66cc

Score

1^/10

Malware Config

Signatures

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2576	NOTEPAD.EXE

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 1800 wrote to memory of 2936	1800	cmd.exe	29
PID 1800 wrote to memory of 2936	1800	cmd.exe	29
PID 1800 wrote to memory of 2936	1800	cmd.exe	29

C:\Windows\system32\cmd.exe
cmd /c "C:\Users\Admin\AppData\Local\Temp\voris.bat"
1⤵
- Suspicious use of WriteProcessMemory
PID:1800
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c "C:\Users\Admin\AppData\Local\Temp\batch.bat admin"
  2⤵
  PID:2936

C:\Windows\System32\NOTEPAD.EXE
"C:\Windows\System32\NOTEPAD.EXE" C:\Users\Admin\Desktop\New Text Document.bat
1⤵
- Suspicious use of FindShellTrayWindow
PID:2576

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads