1072efad667d604f609fd850a13e54507e23b5ad33b836436267144a4cbd28e2 | Triage™

Analysis

max time kernel
155s
max time network
157s
platform
windows11-21h2_x64
resource
win11-20240802-en
resource tags

arch:x64arch:x86image:win11-20240802-enlocale:en-usos:windows11-21h2-x64system
submitted
07/08/2024, 22:32

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
Blank-Grabber-main/Blank Grabber/Builder.bat
Size 1KB
Sample240807-2f4vmaygmh
SHA256 79e1377ac17e6aece067d4cf6a202d8baf43a9906cea353de7188c43b20500c8
MD5 69f3538d09da509b93329b22fd59a956
SHA1 d74ccc96102895e111712beedabcdc725fb23360
SHA512 a5e2fdeb2d185acda43e6a0d964966fc5246d2fe598d094e0b59bd757c42170d3e4125cf7da736080a95141b453d12a53af295eb53bd64e431285e8213da9b07
MD5 SHA1 SHA512

Score

1^/10

Malware Config

Signatures

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 1016 wrote to memory of 4640	1016	cmd.exe	82
PID 1016 wrote to memory of 4640	1016	cmd.exe	82
PID 1016 wrote to memory of 4640	1016	cmd.exe	82

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\Blank-Grabber-main\Blank Grabber\Builder.bat"
1⤵
- Suspicious use of WriteProcessMemory
PID:1016
- C:\Program Files\WindowsApps\Microsoft.DesktopAppInstaller_1.0.42251.0_x64__8wekyb3d8bbwe\AppInstallerPythonRedirector.exe
  python --version
  2⤵
  PID:4640

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

AILog.txt

Path C:\Users\Admin\AppData\Local\Packages\Microsoft.DesktopAppInstaller_8wekyb3d8bbwe\TempState\AILog.txt
Size 490B
SHA256 5364f4d7bf3f4ac70e916509ea0eac2edc78d8c75df1dfc0152d888a50a70eac
MD5 70fc772fda897e7188646531ff21823e
SHA1 4f2cad0711e45873dbdf618039b9eb807155f567
SHA512 772895b00a884fccd6618aa6a16fd161a0c4002b95f9378631619e0d45c7bf7387436773223294a547c6909340fa9e157170877205aa4d7be75ef74eaa13a524
MD5 SHA1 SHA512

Submit Download