caff60a64e47bb705c360a3e6bc0323ea2eb597f8ae5ecdb82d7ad7878e1a063 | Triage

Analysis

max time kernel
122s
max time network
123s
platform
windows7_x64
resource
win7-20240708-en
resource tags

arch:x64arch:x86image:win7-20240708-enlocale:en-usos:windows7-x64system
submitted
19/08/2024, 11:00

Sharing

Report Analysis Logs

General

Target

RestoreSettings.bat
Size

168B
MD5

3982dda00a605f7e73d67e88bf6b0c71
SHA1

dd590a8d65ae93b946e4bac9bc34b6b50f9ad795
SHA256

349447b435c01548dce3de4f04fffb418423bb3f5a613d3bf80df54e89bbf9e8
SHA512

0adcbb11ad0378a89dd5c5c4c31654d8309f4a7d909c08fa52012689c8ec82e7a1cd9b0d5523a51bf9d9038369071f4dfbfc4fab1cc158e4ee33eb39d7ea357c

Score

1^/10

Malware Config

Signatures

Runs .reg file with regedit 1 IoCs

pid	Process
2732	regedit.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2660 wrote to memory of 2732	2660	cmd.exe	32
PID 2660 wrote to memory of 2732	2660	cmd.exe	32
PID 2660 wrote to memory of 2732	2660	cmd.exe	32

C:\Windows\system32\cmd.exe
cmd /c "C:\Users\Admin\AppData\Local\Temp\RestoreSettings.bat"
1⤵
- Suspicious use of WriteProcessMemory
PID:2660
- C:\Windows\regedit.exe
  regedit ISOCommanderSettings.reg
  2⤵
  - Runs .reg file with regedit
  PID:2732

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2732-0-0x00000000001A0000-0x00000000001A1000-memory.dmp

Filesize
4KB

Download
memory/2732-1-0x00000000001A0000-0x00000000001A1000-memory.dmp

Filesize
4KB

Download