d476e788f017f776e8dcd8dc585a51a21f72a0a28a4e752ec0dbeee12795ed12 | Triage

Analysis

max time kernel
94s
max time network
96s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
02/09/2024, 11:52

Sharing

Report Analysis Logs

General

Target

NoSystem/Run.bat
Size

81B
MD5

a57b7bfff7ac115691a2a43b52dc3b5e
SHA1

94382a3a2af0e8ac2e2a413aeace5e61620e543a
SHA256

ceeb06b1f9b5087465abb7c1b904c8a7160a868bc0d9fd0115e261daebd7da82
SHA512

b2320cbfbeffcfce43a905874e7454264bd8e7603e7e5bbf8c8abbfd89690beff708dcf4b6b277e0df05ffc6771bc229260af019eeb9d653e71905dcf4fd1d08

Score

1^/10

Malware Config

Signatures

Runs net.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 4116 wrote to memory of 4560	4116	cmd.exe	84
PID 4116 wrote to memory of 4560	4116	cmd.exe	84
PID 4560 wrote to memory of 4964	4560	net.exe	85
PID 4560 wrote to memory of 4964	4560	net.exe	85

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\NoSystem\Run.bat"
1⤵
- Suspicious use of WriteProcessMemory
PID:4116
- C:\Windows\system32\net.exe
  Net session
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:4560
- - C:\Windows\system32\net1.exe
    C:\Windows\system32\net1 session
    3⤵
    PID:4964

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads