b404c31f75854ce5f7936171cda93166408a03713511eff123057fc743e37efe | Triage

Analysis

max time kernel
92s
max time network
94s
platform
windows11-21h2_x64
resource
win11-20240709-en
resource tags

arch:x64arch:x86image:win11-20240709-enlocale:en-usos:windows11-21h2-x64system
submitted
23/07/2024, 20:05

Sharing

Report Analysis Logs

General

Target

orbital.bat
Size

1KB
MD5

104fcb43193bfc60cd3b346b7646820b
SHA1

06fe14080269e56f25f2c96aaaa357496f4c89ec
SHA256

b404c31f75854ce5f7936171cda93166408a03713511eff123057fc743e37efe
SHA512

fd089a3910511016903563960fe208be63e3d0bc7d8994990dd7f7034f4c6e0de2522dbe4e50a9b3ec703c2c8b19aea259631ec2e4efcdc1b64ce8ba7672df65

Score

1^/10

Malware Config

Signatures

Suspicious use of WriteProcessMemory 2 IoCs

description	pid	Process	procid_target
PID 396 wrote to memory of 3704	396	cmd.exe	82
PID 396 wrote to memory of 3704	396	cmd.exe	82

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\orbital.bat"
1⤵
- Suspicious use of WriteProcessMemory
PID:396
- C:\Windows\system32\chcp.com
  chcp 65001
  2⤵
  PID:3704

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads