47961c394d3b03bd1670e702b2ac59071dc54535657c82772e08e0a2d767b7c4 | Triage

Analysis

max time kernel
434s
max time network
1165s
platform
windows11-21h2_x64
resource
win11-20240802-en
resource tags

arch:x64arch:x86image:win11-20240802-enlocale:en-usos:windows11-21h2-x64system
submitted
10/08/2024, 13:31

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

mineways/scripting/register-Mineways-run-as-administrator.bat
Size

579B
MD5

1f56dc3b1ed82c95d8b4f4a8d8502f19
SHA1

ee5fa946b086a902df9658101f8c42475f4449c6
SHA256

e03871200f6a089f6403fcba8bbda2f1721121d46719f18378699868a0ea1330
SHA512

5e4b644bdc79f5d9e45e8deea60c4be306ae7a8890980116396f29112569897c2ed9aaa47c38d82eb26e3a3ad4829618fbaf095ef729cb8015f42a380e95ac2b

Score

1^/10

Malware Config

Signatures

Modifies registry class 7 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Mineways\Shell\Open\Command	cmd.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Mineways\Shell\Open\Command\ = "C:\\Users\\erich\\Downloads\\mineways1009\\mineways\\mineways.exe \"%1\""	cmd.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.mwscript	cmd.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.mwscript\ = "Mineways"	cmd.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Mineways	cmd.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Mineways\Shell	cmd.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Mineways\Shell\Open	cmd.exe

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\mineways\scripting\register-Mineways-run-as-administrator.bat"
1⤵
- Modifies registry class
PID:4288

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads