83f1f42c79ef91838fc40ca73a459f839c10e3e0fbcfb58a10a360815f16e331

Analysis

max time kernel
121s
max time network
122s
platform
windows7_x64
resource
win7-20240705-en
resource tags

arch:x64arch:x86image:win7-20240705-enlocale:en-usos:windows7-x64system
submitted
23/08/2024, 16:02

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

NeonWare Free Spoofer/Trace Cleaner.bat
Size

341KB
MD5

5f6fd17fb702afac533f50fc5da949da
SHA1

e299bb87fc9e2488fb4fbeed5a978481e91de1cb
SHA256

0849640cf3916192e2a7b51c82f96273fa735bc905a56c29dd32e12151ab25c2
SHA512

3183f0e86e7b01067b48714dd41fdcec5d149307b7fa0fbce3ee9ee4661c436edeab5486dad351345865fabf95208e87315499458992626107d01ce2d1790264
SSDEEP

1536:dAIO30PsLcLjLpLvLrTUCCSyzVj0abpKfjNwYxoReUr648ainAD:uIO/CCSyFl7eUr6pPnAD

Score

7^/10

discovery

Malware Config

Signatures

Modifies file permissions 1 TTPs 1 IoCs

discovery

File and Directory Permissions Modification

T1222

pid	Process
2780	icacls.exe

Delays execution with timeout.exe 1 IoCs

evasion

pid	Process
3020	timeout.exe

Suspicious use of WriteProcessMemory 9 IoCs

description	pid	Process	procid_target
PID 2704 wrote to memory of 2780	2704	cmd.exe	32
PID 2704 wrote to memory of 2780	2704	cmd.exe	32
PID 2704 wrote to memory of 2780	2704	cmd.exe	32
PID 2704 wrote to memory of 2824	2704	cmd.exe	33
PID 2704 wrote to memory of 2824	2704	cmd.exe	33
PID 2704 wrote to memory of 2824	2704	cmd.exe	33
PID 2704 wrote to memory of 3020	2704	cmd.exe	34
PID 2704 wrote to memory of 3020	2704	cmd.exe	34
PID 2704 wrote to memory of 3020	2704	cmd.exe	34

C:\Windows\system32\cmd.exe
cmd /c "C:\Users\Admin\AppData\Local\Temp\NeonWare Free Spoofer\Trace Cleaner.bat"
1⤵
- Suspicious use of WriteProcessMemory
PID:2704
- C:\Windows\system32\icacls.exe
  "C:\Windows\system32\icacls.exe" "C:\Windows\system32\config\system"
  2⤵
  - Modifies file permissions
  PID:2780
- C:\Windows\system32\reg.exe
  reg query "HKCU\Software\Applehmm" /v "True"
  2⤵
  PID:2824
- C:\Windows\system32\timeout.exe
  timeout /t 5
  2⤵
  - Delays execution with timeout.exe
  PID:3020

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

File and Directory Permissions Modification

T1222

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads