070f50f1251bd40e826d571f116e9f76779cfcf5cc290e2d11b0dd9995474707 | Triage

Analysis

max time kernel
122s
max time network
122s
platform
windows7_x64
resource
win7-20240708-en
resource tags

arch:x64arch:x86image:win7-20240708-enlocale:en-usos:windows7-x64system
submitted
24/08/2024, 07:20

Sharing

Report Analysis Logs

General

Target

StartRootkit.bat
Size

39B
MD5

8767902333b39763c0c7cd594a920012
SHA1

73f68b28624a05686d7b477e52ffb85487439b96
SHA256

b1325805788f367ad933fbb39a2f8c1437d5e38b1ea01eed2e6d31b7ac5564da
SHA512

bf59e5afd62d254a0c9c7f99a381c533d45cdc3d9d8a0fd189fc00a3c784f261960d9862c68db3e7df0639020588a11acfa83c42a0c48843f1c0d8eda014bac1

Score

1^/10

Malware Config

Signatures

Suspicious behavior: CmdExeWriteProcessMemorySpam 1 IoCs

pid	Process
3004	nvnsvc.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2136 wrote to memory of 3004	2136	cmd.exe	31
PID 2136 wrote to memory of 3004	2136	cmd.exe	31
PID 2136 wrote to memory of 3004	2136	cmd.exe	31
PID 2136 wrote to memory of 3004	2136	cmd.exe	31

C:\Windows\system32\cmd.exe
cmd /c "C:\Users\Admin\AppData\Local\Temp\StartRootkit.bat"
1⤵
- Suspicious use of WriteProcessMemory
PID:2136
- C:\Users\Admin\AppData\Local\Temp\nvnsvc.exe
  nvnsvc.exe nvnsvc.ini -:installonly
  2⤵
  - Suspicious behavior: CmdExeWriteProcessMemorySpam
  PID:3004

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/3004-2-0x0000000000220000-0x00000000002A8000-memory.dmp

Filesize
544KB

Download
memory/3004-1-0x0000000000590000-0x000000000061B000-memory.dmp

Filesize
556KB

Download