5c4f9d8f0407f06ffccb81aea1fd76a31feeb0fe2838014ffb56c13d90c0e911

Analysis

max time kernel
94s
max time network
124s
platform
windows10-2004_x64
resource
win10v2004-20240709-en
resource tags

arch:x64arch:x86image:win10v2004-20240709-enlocale:en-usos:windows10-2004-x64system
submitted
19/07/2024, 12:30

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
temp.bat
Size 34B
Sample240719-ppxfpavbpb
SHA256 b8d62c3a25475c460e5cb29960214054db402b3bbee2b2189007f88d8476c0c2
MD5 f7cc88b1234579d51627a82f6074a328
SHA1 fba6b2e6bded5432e93df1b8244e525b7dcada58
SHA512 1c82b442a9b80f26c029159c54915c321cd8b60ac99bb86fb49829212015679f36dd9a25d0247f0278fdaccc7dbdba04997cc2bd25100ce439cbd2c62524a5ad
MD5 SHA1 SHA512

Score

5^/10

Malware Config

Signatures

AutoIT Executable 5 IoCs

AutoIT scripts compiled to PE executables.

resource	yara_rule
behavioral2/memory/4072-0-0x0000000000100000-0x00000000001F1000-memory.dmp	autoit_exe
behavioral2/memory/4072-2-0x0000000000100000-0x00000000001F1000-memory.dmp	autoit_exe
behavioral2/memory/4072-3-0x0000000000100000-0x00000000001F1000-memory.dmp	autoit_exe
behavioral2/memory/4072-1-0x0000000000100000-0x00000000001F1000-memory.dmp	autoit_exe
behavioral2/memory/4072-4-0x0000000000100000-0x00000000001F1000-memory.dmp	autoit_exe

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 1956 set thread context of 4072	1956	AutoIt3.exe	90

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2804	4072	WerFault.exe	90

Suspicious use of FindShellTrayWindow 5 IoCs

pid	Process
1956	AutoIt3.exe
1956	AutoIt3.exe
1956	AutoIt3.exe
1956	AutoIt3.exe
1956	AutoIt3.exe

Suspicious use of SendNotifyMessage 5 IoCs

pid	Process
1956	AutoIt3.exe
1956	AutoIt3.exe
1956	AutoIt3.exe
1956	AutoIt3.exe
1956	AutoIt3.exe

Suspicious use of WriteProcessMemory 10 IoCs

description	pid	Process	procid_target
PID 5004 wrote to memory of 3168	5004	cmd.exe	85
PID 5004 wrote to memory of 3168	5004	cmd.exe	85
PID 3168 wrote to memory of 1956	3168	cmd.exe	86
PID 3168 wrote to memory of 1956	3168	cmd.exe	86
PID 3168 wrote to memory of 1956	3168	cmd.exe	86
PID 1956 wrote to memory of 4072	1956	AutoIt3.exe	90
PID 1956 wrote to memory of 4072	1956	AutoIt3.exe	90
PID 1956 wrote to memory of 4072	1956	AutoIt3.exe	90
PID 1956 wrote to memory of 4072	1956	AutoIt3.exe	90
PID 1956 wrote to memory of 4072	1956	AutoIt3.exe	90

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\temp.bat"
1⤵
- Suspicious use of WriteProcessMemory
PID:5004
- C:\Windows\system32\cmd.exe
  cmd.exe /c AutoIt3.exe AutoIt3.a3x
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:3168
- - C:\Users\Admin\AppData\Local\Temp\AutoIt3.exe
    AutoIt3.exe AutoIt3.a3x
    3⤵
    - Suspicious use of SetThreadContext
    - Suspicious use of FindShellTrayWindow
    - Suspicious use of SendNotifyMessage
    - Suspicious use of WriteProcessMemory
    PID:1956
  - - C:\Users\Admin\AppData\Local\Temp\AutoIt3.exe
      "C:\Users\Admin\AppData\Local\Temp\AutoIt3.exe"
      4⤵
      PID:4072
    - - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 4072 -s 600
        5⤵
        Program crash
        
        PID:2804

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 4072 -ip 4072
1⤵
PID:1180

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/4072-0-0x0000000000100000-0x00000000001F1000-memory.dmp

Download

memory/4072-2-0x0000000000100000-0x00000000001F1000-memory.dmp

Download

memory/4072-3-0x0000000000100000-0x00000000001F1000-memory.dmp

Download

memory/4072-1-0x0000000000100000-0x00000000001F1000-memory.dmp

Download

memory/4072-4-0x0000000000100000-0x00000000001F1000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads