6301a33709f67757e3e4ce1fcf6ac38a99779d37fa886d5caa5fb18f9f173140 | Triage

Analysis

max time kernel
387s
max time network
392s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
07/09/2024, 23:01

Sharing

Report Analysis Logs

General

Target

Defender.bat
Size

1KB
MD5

7e5b21528e17e4a06b6be3138251dc64
SHA1

fc573ea384ed1ea667f29c396d6820ef95936a66
SHA256

6301a33709f67757e3e4ce1fcf6ac38a99779d37fa886d5caa5fb18f9f173140
SHA512

3dc1e8bfcaee1fcfd31efc69445724c1c716930470fac8e378e9db673ccc3b34576b3e720c110e7f9651c38f1bc0a4500573b197e081c7a4fd97718a67b874fb

Score

1^/10

Malware Config

Signatures

Delays execution with timeout.exe 1 IoCs

pid	Process
1836	timeout.exe

Suspicious use of WriteProcessMemory 2 IoCs

description	pid	Process	procid_target
PID 1016 wrote to memory of 1836	1016	cmd.exe	100
PID 1016 wrote to memory of 1836	1016	cmd.exe	100

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\Defender.bat"
1⤵
- Suspicious use of WriteProcessMemory
PID:1016
- C:\Windows\system32\timeout.exe
  timeout /t 2
  2⤵
  - Delays execution with timeout.exe
  PID:1836

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --field-trial-handle=1288,i,11251706013556949551,5157034131170452377,262144 --variations-seed-version --mojo-platform-channel-handle=4380 /prefetch:8
1⤵
PID:392

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:4724

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads