f70f25aa2bdb13440fe1f8a2ba8fdd4709a4ebe47cc03bf15e5822b0fbe73afb

Analysis

max time kernel
139s
max time network
123s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
12/08/2024, 05:35

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

ตัวไหล.bat
Size

401B
MD5

a52d6fa560c6a65a8bf5b3c1602fa532
SHA1

e515aab8fecc60e1c8217098bc94d03597e2dc59
SHA256

f70f25aa2bdb13440fe1f8a2ba8fdd4709a4ebe47cc03bf15e5822b0fbe73afb
SHA512

f9f8f6e88238c128d4f2a620287a8c55cf34325c7dd2a9cc659d2619d687e716cb02e216fd60ae69f94d4942374b975d65eee62ab561da2aa164fef33f33d5fe

Score

3^/10

discovery persistence privilege_escalation

Malware Config

Signatures

Event Triggered Execution: Netsh Helper DLL 1 TTPs 3 IoCs

Netsh.exe (also referred to as Netshell) is a command-line scripting utility used to interact with the network configuration of a system.

persistence privilege_escalation

Netsh Helper DLL

T1546.007

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe

System Time Discovery 1 TTPs 2 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
4408	net1.exe
3968	net.exe

Delays execution with timeout.exe 3 IoCs

evasion

pid	Process
4644	timeout.exe
1532	timeout.exe
4456	timeout.exe

Gathers network information 2 TTPs 1 IoCs

Uses commandline utility to view network configuration.

System Information Discovery

T1082

Command and Scripting Interpreter

T1059

pid	Process
1624	ipconfig.exe

Runs net.exe

Suspicious use of WriteProcessMemory 14 IoCs

description	pid	Process	procid_target
PID 1880 wrote to memory of 4644	1880	cmd.exe	85
PID 1880 wrote to memory of 4644	1880	cmd.exe	85
PID 1880 wrote to memory of 1532	1880	cmd.exe	91
PID 1880 wrote to memory of 1532	1880	cmd.exe	91
PID 1880 wrote to memory of 4456	1880	cmd.exe	95
PID 1880 wrote to memory of 4456	1880	cmd.exe	95
PID 1880 wrote to memory of 3100	1880	cmd.exe	97
PID 1880 wrote to memory of 3100	1880	cmd.exe	97
PID 1880 wrote to memory of 1624	1880	cmd.exe	98
PID 1880 wrote to memory of 1624	1880	cmd.exe	98
PID 1880 wrote to memory of 3968	1880	cmd.exe	99
PID 1880 wrote to memory of 3968	1880	cmd.exe	99
PID 3968 wrote to memory of 4408	3968	net.exe	100
PID 3968 wrote to memory of 4408	3968	net.exe	100

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\ตัวไหล.bat"
1⤵
- Suspicious use of WriteProcessMemory
PID:1880
- C:\Windows\system32\timeout.exe
  timeout 3
  2⤵
  - Delays execution with timeout.exe
  PID:4644
- C:\Windows\system32\timeout.exe
  timeout 5
  2⤵
  - Delays execution with timeout.exe
  PID:1532
- C:\Windows\system32\timeout.exe
  timeout 3
  2⤵
  - Delays execution with timeout.exe
  PID:4456
- C:\Windows\system32\netsh.exe
  netsh winsock reset
  2⤵
  - Event Triggered Execution: Netsh Helper DLL
  PID:3100
- C:\Windows\system32\ipconfig.exe
  ipconfig /flushdns
  2⤵
  - Gathers network information
  PID:1624
- C:\Windows\system32\net.exe
  net stop w32time
  2⤵
  - System Time Discovery
  - Suspicious use of WriteProcessMemory
  PID:3968
- - C:\Windows\system32\net1.exe
    C:\Windows\system32\net1 stop w32time
    3⤵
    - System Time Discovery
    PID:4408

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Persistence

Event Triggered Execution

T1546

Netsh Helper DLL

T1546.007

Privilege Escalation

Event Triggered Execution

T1546

Netsh Helper DLL

T1546.007

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Windows 7 deprecation

Loading Replay Monitor...

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads