cb778cd8399b5b8f3c697c27f99307270848e2c5e0c4c24ffeb46e01fe045764

Analysis

max time kernel
95s
max time network
130s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
01/09/2024, 17:30

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

windick-main/windick.cmd
Size

227KB
MD5

b3922bb24876619dab9840a7cfaf7905
SHA1

161b62032137d2ba93a32886ed8a458e6ad3e3cc
SHA256

75c811c65fb3d5fed307bfffe96d75aea2e7e3d5aeb14dd3bd641bdb54bc28e3
SHA512

a04cca4750a2a2877923920b1b1afad02d1c4b2f88c80895f5d51d752ae6c8859d77bf30faa8e59dbaf5e8e54d42c9660bb9ff5d25e403d237615485ac485a68
SSDEEP

6144:vA5awmfnemRidZGi8TrKn+l3jzzDEyxbgQHrgDQjmYo+6xv94FQzAa:EawmfnemRidZGi8TrKnYzDE6gQHrgDQg

Score

1^/10

Malware Config

Signatures

Suspicious use of WriteProcessMemory 20 IoCs

description	pid	Process	procid_target
PID 5096 wrote to memory of 5104	5096	cmd.exe	83
PID 5096 wrote to memory of 5104	5096	cmd.exe	83
PID 5096 wrote to memory of 4656	5096	cmd.exe	84
PID 5096 wrote to memory of 4656	5096	cmd.exe	84
PID 5096 wrote to memory of 5064	5096	cmd.exe	85
PID 5096 wrote to memory of 5064	5096	cmd.exe	85
PID 5096 wrote to memory of 4620	5096	cmd.exe	86
PID 5096 wrote to memory of 4620	5096	cmd.exe	86
PID 4620 wrote to memory of 632	4620	cmd.exe	87
PID 4620 wrote to memory of 632	4620	cmd.exe	87
PID 4620 wrote to memory of 1420	4620	cmd.exe	88
PID 4620 wrote to memory of 1420	4620	cmd.exe	88
PID 5096 wrote to memory of 4996	5096	cmd.exe	89
PID 5096 wrote to memory of 4996	5096	cmd.exe	89
PID 4996 wrote to memory of 2264	4996	cmd.exe	90
PID 4996 wrote to memory of 2264	4996	cmd.exe	90
PID 5096 wrote to memory of 1248	5096	cmd.exe	91
PID 5096 wrote to memory of 1248	5096	cmd.exe	91
PID 1248 wrote to memory of 688	1248	cmd.exe	92
PID 1248 wrote to memory of 688	1248	cmd.exe	92

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\windick-main\windick.cmd"
1⤵
- Suspicious use of WriteProcessMemory
PID:5096
- C:\Windows\system32\chcp.com
  CHCP 437
  2⤵
  PID:5104
- C:\Windows\system32\reg.exe
  Reg.exe query "HKU\S-1-5-19\Environment"
  2⤵
  PID:4656
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c ECHO.C:\Users\Admin\AppData\Local\Temp\windick-main
  2⤵
  PID:5064
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c CMD.EXE /D /U /C ECHO.C:\USERS\ADMIN\APPDATA\LOCAL\TEMP\WINDICK-MAIN| FIND /V ""
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:4620
- - C:\Windows\system32\cmd.exe
    CMD.EXE /D /U /C ECHO.C:\USERS\ADMIN\APPDATA\LOCAL\TEMP\WINDICK-MAIN
    3⤵
    PID:632
- - C:\Windows\system32\find.exe
    FIND /V ""
    3⤵
    PID:1420
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c REG QUERY "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Authentication\LogonUI" /v LastLoggedOnUser 2>NUL
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:4996
- - C:\Windows\system32\reg.exe
    REG QUERY "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Authentication\LogonUI" /v LastLoggedOnUser
    3⤵
    PID:2264
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c REG QUERY "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Authentication\LogonUI" /v LastLoggedOnUserSID 2>NUL
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1248
- - C:\Windows\system32\reg.exe
    REG QUERY "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Authentication\LogonUI" /v LastLoggedOnUserSID
    3⤵
    PID:688

Windows 7 deprecation

Loading Replay Monitor...

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads