9235d2676794ff9cc054258ec08e894647ed0112a94f078c9b901d8f1aa049ce | Triage

Analysis

max time kernel
16s
max time network
20s
platform
windows7_x64
resource
win7-20240708-en
resource tags

arch:x64arch:x86image:win7-20240708-enlocale:en-usos:windows7-x64system
submitted
08/09/2024, 12:02

Sharing

Report Analysis Logs

General

Target

Files/BackupRegistry.bat
Size

777B
MD5

4017211c6557001aaf377c59ecee083d
SHA1

136dd376f582cd0191d87580819881c6a636c271
SHA256

1da84dbf28ed8a7db5f8bb12f3a3541fe3fae630c7caefa113210d5f273ddf9e
SHA512

0a76f2e9f8eefd416174cda713c30e1ab62a60783f2df4aeb402a48a80f3051c0fcb6061f8e12501f796a3e12f80df54d1db5f7b467f07849682e7fa1319b262

Score

1^/10

Malware Config

Signatures

Suspicious use of WriteProcessMemory 12 IoCs

description	pid	Process	procid_target
PID 2528 wrote to memory of 1920	2528	cmd.exe	30
PID 2528 wrote to memory of 1920	2528	cmd.exe	30
PID 2528 wrote to memory of 1920	2528	cmd.exe	30
PID 1920 wrote to memory of 2692	1920	cmd.exe	31
PID 1920 wrote to memory of 2692	1920	cmd.exe	31
PID 1920 wrote to memory of 2692	1920	cmd.exe	31
PID 2528 wrote to memory of 2260	2528	cmd.exe	32
PID 2528 wrote to memory of 2260	2528	cmd.exe	32
PID 2528 wrote to memory of 2260	2528	cmd.exe	32
PID 2528 wrote to memory of 456	2528	cmd.exe	33
PID 2528 wrote to memory of 456	2528	cmd.exe	33
PID 2528 wrote to memory of 456	2528	cmd.exe	33

C:\Windows\system32\cmd.exe
cmd /c "C:\Users\Admin\AppData\Local\Temp\Files\BackupRegistry.bat"
1⤵
- Suspicious use of WriteProcessMemory
PID:2528
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c chcp
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1920
- - C:\Windows\system32\chcp.com
    chcp
    3⤵
    PID:2692
- C:\Windows\system32\chcp.com
  chcp 65001
  2⤵
  PID:2260
- C:\Windows\system32\chcp.com
  chcp 437
  2⤵
  PID:456

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads