ff95ef4991b31a1e2d3a0acbccb205234842bf2e1157510846d01136a6b26a31 | Triage

Analysis

max time kernel
120s
max time network
129s
platform
windows7_x64
resource
win7-20240705-en
resource tags

arch:x64arch:x86image:win7-20240705-enlocale:en-usos:windows7-x64system
submitted
15-07-2024 10:20

Sharing

Report Analysis Logs

General

Target

UB Downloads 12.6.24/UB Downloads 12.6.24/UB Downloads/Unlock All/bsod fix.bat
Size

415B
MD5

392f331dc1744fbe560a2a17d7ca838f
SHA1

817559945e137d036f47b26696d4fab5f22572c1
SHA256

318ae14fd3712848ed06c109d36a9df600964e1d827581f980c121d52a7b5df5
SHA512

0b1023402d8bf343cdee0e1e643209a65879dca4a7e22862b28ba08dea2d1a72ff651ab757ce32ad11add2aad61b44f36a64d1c754bdbe1ea740c44c2857c0dd

Score

1^/10

Malware Config

Signatures

Runs net.exe

Suspicious use of WriteProcessMemory 12 IoCs

Processes:

cmd.exenet.exe

description	pid	process	target process
PID 656 wrote to memory of 3000	656	cmd.exe	net.exe
PID 656 wrote to memory of 3000	656	cmd.exe	net.exe
PID 656 wrote to memory of 3000	656	cmd.exe	net.exe
PID 3000 wrote to memory of 2784	3000	net.exe	net1.exe
PID 3000 wrote to memory of 2784	3000	net.exe	net1.exe
PID 3000 wrote to memory of 2784	3000	net.exe	net1.exe
PID 656 wrote to memory of 1748	656	cmd.exe	reg.exe
PID 656 wrote to memory of 1748	656	cmd.exe	reg.exe
PID 656 wrote to memory of 1748	656	cmd.exe	reg.exe
PID 656 wrote to memory of 3036	656	cmd.exe	reg.exe
PID 656 wrote to memory of 3036	656	cmd.exe	reg.exe
PID 656 wrote to memory of 3036	656	cmd.exe	reg.exe

C:\Windows\system32\cmd.exe
cmd /c "C:\Users\Admin\AppData\Local\Temp\UB Downloads 12.6.24\UB Downloads 12.6.24\UB Downloads\Unlock All\bsod fix.bat"
1⤵
- Suspicious use of WriteProcessMemory
PID:656

C:\Windows\system32\net.exe
NET SESSION
2⤵
- Suspicious use of WriteProcessMemory
PID:3000

C:\Windows\system32\net1.exe
C:\Windows\system32\net1 SESSION
3⤵
PID:2784

C:\Windows\system32\reg.exe
reg add "HKLM\SYSTEM\CurrentControlSet\Control\Session Manager\Memory Management" /v FeatureSettingsOverride /t REG_DWORD /d 3
2⤵
PID:1748

C:\Windows\system32\reg.exe
reg add "HKLM\SYSTEM\CurrentControlSet\Control\Session Manager\Memory Management" /v FeatureSettingsOverrideMask /t REG_DWORD /d 3
2⤵
PID:3036

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads