Overview
overview
9Static
static
3UB Downloa...ix.bat
windows7-x64
1UB Downloa...ix.bat
windows10-2004-x64
1UB Downloa...h2.exe
windows7-x64
5UB Downloa...h2.exe
windows10-2004-x64
5UB Downloa...ix.bat
windows7-x64
9UB Downloa...ix.bat
windows10-2004-x64
9UB Downloa...ix.bat
windows7-x64
1UB Downloa...ix.bat
windows10-2004-x64
1UB Downloa...b1.exe
windows7-x64
5UB Downloa...b1.exe
windows10-2004-x64
5UB Downloa...ix.bat
windows7-x64
9UB Downloa...ix.bat
windows10-2004-x64
9Analysis
-
max time kernel
121s -
max time network
124s -
platform
windows7_x64 -
resource
win7-20240704-en -
resource tags
arch:x64arch:x86image:win7-20240704-enlocale:en-usos:windows7-x64system -
submitted
15-07-2024 10:22
Static task
static1
Behavioral task
behavioral1
Sample
UB Downloads/UB Silent/bsod fix.bat
Resource
win7-20240704-en
Behavioral task
behavioral2
Sample
UB Downloads/UB Silent/bsod fix.bat
Resource
win10v2004-20240709-en
Behavioral task
behavioral3
Sample
UB Downloads/UB Silent/u237cgatAh2.exe
Resource
win7-20240704-en
Behavioral task
behavioral4
Sample
UB Downloads/UB Silent/u237cgatAh2.exe
Resource
win10v2004-20240709-en
Behavioral task
behavioral5
Sample
UB Downloads/UB Silent/w11 fix.bat
Resource
win7-20240704-en
Behavioral task
behavioral6
Sample
UB Downloads/UB Silent/w11 fix.bat
Resource
win10v2004-20240709-en
Behavioral task
behavioral7
Sample
UB Downloads/Unlock All/bsod fix.bat
Resource
win7-20240704-en
Behavioral task
behavioral8
Sample
UB Downloads/Unlock All/bsod fix.bat
Resource
win10v2004-20240709-en
Behavioral task
behavioral9
Sample
UB Downloads/Unlock All/nRi28Wtqb1.exe
Resource
win7-20240708-en
Behavioral task
behavioral10
Sample
UB Downloads/Unlock All/nRi28Wtqb1.exe
Resource
win10v2004-20240704-en
Behavioral task
behavioral11
Sample
UB Downloads/Unlock All/w11 fix.bat
Resource
win7-20240704-en
Behavioral task
behavioral12
Sample
UB Downloads/Unlock All/w11 fix.bat
Resource
win10v2004-20240709-en
General
-
Target
UB Downloads/UB Silent/bsod fix.bat
-
Size
415B
-
MD5
392f331dc1744fbe560a2a17d7ca838f
-
SHA1
817559945e137d036f47b26696d4fab5f22572c1
-
SHA256
318ae14fd3712848ed06c109d36a9df600964e1d827581f980c121d52a7b5df5
-
SHA512
0b1023402d8bf343cdee0e1e643209a65879dca4a7e22862b28ba08dea2d1a72ff651ab757ce32ad11add2aad61b44f36a64d1c754bdbe1ea740c44c2857c0dd
Malware Config
Signatures
-
Runs net.exe
-
Suspicious use of WriteProcessMemory 12 IoCs
Processes:
cmd.exenet.exedescription pid process target process PID 2416 wrote to memory of 1816 2416 cmd.exe net.exe PID 2416 wrote to memory of 1816 2416 cmd.exe net.exe PID 2416 wrote to memory of 1816 2416 cmd.exe net.exe PID 1816 wrote to memory of 1812 1816 net.exe net1.exe PID 1816 wrote to memory of 1812 1816 net.exe net1.exe PID 1816 wrote to memory of 1812 1816 net.exe net1.exe PID 2416 wrote to memory of 3008 2416 cmd.exe reg.exe PID 2416 wrote to memory of 3008 2416 cmd.exe reg.exe PID 2416 wrote to memory of 3008 2416 cmd.exe reg.exe PID 2416 wrote to memory of 2412 2416 cmd.exe reg.exe PID 2416 wrote to memory of 2412 2416 cmd.exe reg.exe PID 2416 wrote to memory of 2412 2416 cmd.exe reg.exe
Processes
-
C:\Windows\system32\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\UB Downloads\UB Silent\bsod fix.bat"1⤵
- Suspicious use of WriteProcessMemory
PID:2416 -
C:\Windows\system32\net.exeNET SESSION2⤵
- Suspicious use of WriteProcessMemory
PID:1816 -
C:\Windows\system32\net1.exeC:\Windows\system32\net1 SESSION3⤵PID:1812
-
C:\Windows\system32\reg.exereg add "HKLM\SYSTEM\CurrentControlSet\Control\Session Manager\Memory Management" /v FeatureSettingsOverride /t REG_DWORD /d 32⤵PID:3008
-
C:\Windows\system32\reg.exereg add "HKLM\SYSTEM\CurrentControlSet\Control\Session Manager\Memory Management" /v FeatureSettingsOverrideMask /t REG_DWORD /d 32⤵PID:2412