2b0d41bab6c1322f1d9c4a48a4df33071097d2cd78a4f37e71a7411b9d3371a4

Analysis

max time kernel
181s
max time network
288s
platform
windows11-21h2_x64
resource
win11-20240802-en
resource tags

arch:x64arch:x86image:win11-20240802-enlocale:en-usos:windows11-21h2-x64system
submitted
07-08-2024 16:11

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

sus/data/deleteuser.bat
Size

42B
MD5

c5f2766582f3642b8332c31e105c9742
SHA1

43f937555e5f4616c66fc819446672de07387595
SHA256

162d02688b41c98db6054f6db888216c86a6cf73e565e55dd5f2d24662b25c38
SHA512

0652c578b2d7adab0781ac8c588ff4fdc919ef1f90adc0e6701b3641d52e4ad2eacae80ecb93a1148cac14bc96e56cc5521a675cccefef17beb0106d059ed4b9

Score

8^/10

defense_evasion

Malware Config

Signatures

Indicator Removal: Network Share Connection Removal 1 TTPs 2 IoCs

Adversaries may remove share connections that are no longer useful in order to clean up traces of their operation.

defense_evasion

Network Share Connection Removal

T1070.005

pid	Process
2360	net1.exe
4364	net.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 3284 wrote to memory of 4364	3284	cmd.exe	82
PID 3284 wrote to memory of 4364	3284	cmd.exe	82
PID 4364 wrote to memory of 2360	4364	net.exe	83
PID 4364 wrote to memory of 2360	4364	net.exe	83

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\sus\data\deleteuser.bat"
1⤵
- Suspicious use of WriteProcessMemory
PID:3284
- C:\Windows\system32\net.exe
  net user "Exitlag" /DELETE
  2⤵
  - Indicator Removal: Network Share Connection Removal
  - Suspicious use of WriteProcessMemory
  PID:4364
- - C:\Windows\system32\net1.exe
    C:\Windows\system32\net1 user "Exitlag" /DELETE
    3⤵
    - Indicator Removal: Network Share Connection Removal
    PID:2360

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Indicator Removal

T1070

Network Share Connection Removal

T1070.005

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads