cb778cd8399b5b8f3c697c27f99307270848e2c5e0c4c24ffeb46e01fe045764

Analysis

max time kernel
117s
max time network
125s
platform
windows7_x64
resource
win7-20240704-en
resource tags

arch:x64arch:x86image:win7-20240704-enlocale:en-usos:windows7-x64system
submitted
01-09-2024 17:30

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

windick-main/windick.cmd
Size

227KB
MD5

b3922bb24876619dab9840a7cfaf7905
SHA1

161b62032137d2ba93a32886ed8a458e6ad3e3cc
SHA256

75c811c65fb3d5fed307bfffe96d75aea2e7e3d5aeb14dd3bd641bdb54bc28e3
SHA512

a04cca4750a2a2877923920b1b1afad02d1c4b2f88c80895f5d51d752ae6c8859d77bf30faa8e59dbaf5e8e54d42c9660bb9ff5d25e403d237615485ac485a68
SSDEEP

6144:vA5awmfnemRidZGi8TrKn+l3jzzDEyxbgQHrgDQjmYo+6xv94FQzAa:EawmfnemRidZGi8TrKnYzDE6gQHrgDQg

Score

1^/10

Malware Config

Signatures

Suspicious use of WriteProcessMemory 30 IoCs

description	pid	Process	procid_target
PID 2152 wrote to memory of 2676	2152	cmd.exe	31
PID 2152 wrote to memory of 2676	2152	cmd.exe	31
PID 2152 wrote to memory of 2676	2152	cmd.exe	31
PID 2152 wrote to memory of 2668	2152	cmd.exe	32
PID 2152 wrote to memory of 2668	2152	cmd.exe	32
PID 2152 wrote to memory of 2668	2152	cmd.exe	32
PID 2152 wrote to memory of 2648	2152	cmd.exe	33
PID 2152 wrote to memory of 2648	2152	cmd.exe	33
PID 2152 wrote to memory of 2648	2152	cmd.exe	33
PID 2152 wrote to memory of 2748	2152	cmd.exe	34
PID 2152 wrote to memory of 2748	2152	cmd.exe	34
PID 2152 wrote to memory of 2748	2152	cmd.exe	34
PID 2748 wrote to memory of 2744	2748	cmd.exe	35
PID 2748 wrote to memory of 2744	2748	cmd.exe	35
PID 2748 wrote to memory of 2744	2748	cmd.exe	35
PID 2748 wrote to memory of 2756	2748	cmd.exe	36
PID 2748 wrote to memory of 2756	2748	cmd.exe	36
PID 2748 wrote to memory of 2756	2748	cmd.exe	36
PID 2152 wrote to memory of 2820	2152	cmd.exe	37
PID 2152 wrote to memory of 2820	2152	cmd.exe	37
PID 2152 wrote to memory of 2820	2152	cmd.exe	37
PID 2820 wrote to memory of 2780	2820	cmd.exe	38
PID 2820 wrote to memory of 2780	2820	cmd.exe	38
PID 2820 wrote to memory of 2780	2820	cmd.exe	38
PID 2152 wrote to memory of 2740	2152	cmd.exe	39
PID 2152 wrote to memory of 2740	2152	cmd.exe	39
PID 2152 wrote to memory of 2740	2152	cmd.exe	39
PID 2740 wrote to memory of 2696	2740	cmd.exe	40
PID 2740 wrote to memory of 2696	2740	cmd.exe	40
PID 2740 wrote to memory of 2696	2740	cmd.exe	40

C:\Windows\system32\cmd.exe
cmd /c "C:\Users\Admin\AppData\Local\Temp\windick-main\windick.cmd"
1⤵
- Suspicious use of WriteProcessMemory
PID:2152
- C:\Windows\system32\chcp.com
  CHCP 437
  2⤵
  PID:2676
- C:\Windows\system32\reg.exe
  Reg.exe query "HKU\S-1-5-19\Environment"
  2⤵
  PID:2668
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c ECHO.C:\Users\Admin\AppData\Local\Temp\windick-main
  2⤵
  PID:2648
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c CMD.EXE /D /U /C ECHO.C:\USERS\ADMIN\APPDATA\LOCAL\TEMP\WINDICK-MAIN| FIND /V ""
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2748
- - C:\Windows\system32\cmd.exe
    CMD.EXE /D /U /C ECHO.C:\USERS\ADMIN\APPDATA\LOCAL\TEMP\WINDICK-MAIN
    3⤵
    PID:2744
- - C:\Windows\system32\find.exe
    FIND /V ""
    3⤵
    PID:2756
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c REG QUERY "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Authentication\LogonUI" /v LastLoggedOnUser 2>NUL
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2820
- - C:\Windows\system32\reg.exe
    REG QUERY "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Authentication\LogonUI" /v LastLoggedOnUser
    3⤵
    PID:2780
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c REG QUERY "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Authentication\LogonUI" /v LastLoggedOnUserSID 2>NUL
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2740
- - C:\Windows\system32\reg.exe
    REG QUERY "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Authentication\LogonUI" /v LastLoggedOnUserSID
    3⤵
    PID:2696

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads