Analysis

  • max time kernel
    149s
  • max time network
    127s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240802-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
  • submitted
    29/08/2024, 14:01

General

  • Target

    scrcpy-win64-v2.6.1/scrcpy-console.bat

  • Size

    51B

  • MD5

    7b8d3b0d87dd886730d4993af807fae1

  • SHA1

    2b1a383c41fc2a571165cd2b640a6b8a936d5559

  • SHA256

    b49a3eb642898269e7e690e80f3de17898f966f69e75f11abeb31eb7023b0ee5

  • SHA512

    805ad1f121432b0edb22fefecffe76e3071ef1eaba073fab0d57e0bee4c379a34f154dbf9fc980c3412a917969275cf7af4528b36746834693687ed7d0011fdd

Score
3/10

Malware Config

Signatures

  • System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • Suspicious use of WriteProcessMemory 11 IoCs

Processes

  • C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\scrcpy-win64-v2.6.1\scrcpy-console.bat"
    1⤵
    • Suspicious use of WriteProcessMemory
    PID:4424
    • C:\Users\Admin\AppData\Local\Temp\scrcpy-win64-v2.6.1\scrcpy.exe
      scrcpy.exe --pause-on-exit=if-error
      2⤵
      • Suspicious use of WriteProcessMemory
      PID:4664
      • C:\Users\Admin\AppData\Local\Temp\scrcpy-win64-v2.6.1\adb.exe
        adb start-server
        3⤵
        • System Location Discovery: System Language Discovery
        • Suspicious use of WriteProcessMemory
        PID:3772
        • C:\Users\Admin\AppData\Local\Temp\scrcpy-win64-v2.6.1\adb.exe
          adb -L tcp:5037 fork-server server --reply-fd 596
          4⤵
          • System Location Discovery: System Language Discovery
          PID:1696
      • C:\Users\Admin\AppData\Local\Temp\scrcpy-win64-v2.6.1\adb.exe
        adb devices -l
        3⤵
          PID:2440

    Network

    MITRE ATT&CK Enterprise v15

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    • memory/4664-3-0x00007FF77F880000-0x00007FF77F999000-memory.dmp

      Filesize

      1.1MB

    • memory/4664-5-0x00007FF82F360000-0x00007FF82F401000-memory.dmp

      Filesize

      644KB

    • memory/4664-8-0x00007FF82F320000-0x00007FF82F35E000-memory.dmp

      Filesize

      248KB

    • memory/4664-9-0x00007FF81F220000-0x00007FF81F5BB000-memory.dmp

      Filesize

      3.6MB

    • memory/4664-7-0x00007FF833310000-0x00007FF833337000-memory.dmp

      Filesize

      156KB

    • memory/4664-6-0x00007FF81F5C0000-0x00007FF81F77A000-memory.dmp

      Filesize

      1.7MB

    • memory/4664-4-0x00007FF81F780000-0x00007FF820896000-memory.dmp

      Filesize

      17.1MB