66cf7d06e6cf6413d3e9e6a488f7528f5c6d06057abec20496f70d1691fbdfb2 | Triage

Analysis

max time kernel
122s
max time network
125s
platform
windows7_x64
resource
win7-20240708-en
resource tags

arch:x64arch:x86image:win7-20240708-enlocale:en-usos:windows7-x64system
submitted
11-08-2024 23:20

Sharing

Report Analysis Logs

General

Target

Downloads 12.6.24/Downloads 12.6.24/Downloads/Unlock All/bsod fix.bat
Size

415B
MD5

392f331dc1744fbe560a2a17d7ca838f
SHA1

817559945e137d036f47b26696d4fab5f22572c1
SHA256

318ae14fd3712848ed06c109d36a9df600964e1d827581f980c121d52a7b5df5
SHA512

0b1023402d8bf343cdee0e1e643209a65879dca4a7e22862b28ba08dea2d1a72ff651ab757ce32ad11add2aad61b44f36a64d1c754bdbe1ea740c44c2857c0dd

Score

1^/10

Malware Config

Signatures

Runs net.exe

Suspicious use of WriteProcessMemory 12 IoCs

Processes:

cmd.exenet.exe

description	pid	process	target process
PID 2340 wrote to memory of 2136	2340	cmd.exe	net.exe
PID 2340 wrote to memory of 2136	2340	cmd.exe	net.exe
PID 2340 wrote to memory of 2136	2340	cmd.exe	net.exe
PID 2136 wrote to memory of 2668	2136	net.exe	net1.exe
PID 2136 wrote to memory of 2668	2136	net.exe	net1.exe
PID 2136 wrote to memory of 2668	2136	net.exe	net1.exe
PID 2340 wrote to memory of 2672	2340	cmd.exe	reg.exe
PID 2340 wrote to memory of 2672	2340	cmd.exe	reg.exe
PID 2340 wrote to memory of 2672	2340	cmd.exe	reg.exe
PID 2340 wrote to memory of 2144	2340	cmd.exe	reg.exe
PID 2340 wrote to memory of 2144	2340	cmd.exe	reg.exe
PID 2340 wrote to memory of 2144	2340	cmd.exe	reg.exe

C:\Windows\system32\cmd.exe
cmd /c "C:\Users\Admin\AppData\Local\Temp\Downloads 12.6.24\Downloads 12.6.24\Downloads\Unlock All\bsod fix.bat"
1⤵
- Suspicious use of WriteProcessMemory
PID:2340

C:\Windows\system32\net.exe
NET SESSION
2⤵
- Suspicious use of WriteProcessMemory
PID:2136

C:\Windows\system32\net1.exe
C:\Windows\system32\net1 SESSION
3⤵
PID:2668

C:\Windows\system32\reg.exe
reg add "HKLM\SYSTEM\CurrentControlSet\Control\Session Manager\Memory Management" /v FeatureSettingsOverride /t REG_DWORD /d 3
2⤵
PID:2672

C:\Windows\system32\reg.exe
reg add "HKLM\SYSTEM\CurrentControlSet\Control\Session Manager\Memory Management" /v FeatureSettingsOverrideMask /t REG_DWORD /d 3
2⤵
PID:2144

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads