6c2e4c5e15176147ab9580ad7f7776b7445e495da651e0aba4e7e4b666b6e6be | Triage

Analysis

max time kernel
31s
max time network
53s
platform
windows11-21h2_x64
resource
win11-20240802-en
resource tags

arch:x64arch:x86image:win11-20240802-enlocale:en-usos:windows11-21h2-x64system
submitted
16-08-2024 16:31

Sharing

Report Analysis Logs

General

Target

SyncPro/testing2.bat
Size

14KB
MD5

e4846ee6a6427fcd98ca20e6d4e50aec
SHA1

910c77705ea0e446823544eb251f8ca6ed95fb30
SHA256

f25d0e768fc9dde8c8f01398c740d63a852339a9fd2b532334da00b064187751
SHA512

b5c7789eff4241b630b2a7446a3124e0192d8b3247c4db33245315ccedd12436a6e45387ac30519897018f06ad1f119773f74dc01b324ea17f78ce58b7cc25a6
SSDEEP

192:WTLtYH4fEmEdN40/IveIThAI8H6dDeOUczJUmcCTJftmN:WTLtbsb/IvZAI8H6dDed7mcCTJFmN

Score

1^/10

Malware Config

Signatures

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-1287768749-810021449-2672985988-1000_Classes\Local Settings	cmd.exe

Runs net.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
6104	OpenWith.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 3272 wrote to memory of 5880	3272	cmd.exe	82
PID 3272 wrote to memory of 5880	3272	cmd.exe	82
PID 5880 wrote to memory of 1176	5880	net.exe	83
PID 5880 wrote to memory of 1176	5880	net.exe	83

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\SyncPro\testing2.bat"
1⤵
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:3272
- C:\Windows\system32\net.exe
  net session
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:5880
- - C:\Windows\system32\net1.exe
    C:\Windows\system32\net1 session
    3⤵
    PID:1176

C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
1⤵
- Suspicious use of SetWindowsHookEx
PID:6104

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads