Analysis

  • max time kernel
    121s
  • max time network
    122s
  • platform
    windows7_x64
  • resource
    win7-20240903-en
  • resource tags

    arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
  • submitted
    11-09-2024 13:23

General

  • Target

    ffdec.bat

  • Size

    786B

  • MD5

    128f871f94216f847a3f119e333f1940

  • SHA1

    955a125f9594199fccbdeca60c630e8f3e15f365

  • SHA256

    12b1b10c3b375720eb3d90b42cfa43e0771d0997e0d94cf304b81d058164fd32

  • SHA512

    de1da5b61ed289177aab1097831f0ac93a79893ca5d2b5a8604d452aaed0398c750fcee93b83b45ff891d2155806410ebe16ab610cec1898c043b81f87c4aa89

Score
1/10

Malware Config

Signatures

  • Suspicious use of WriteProcessMemory 3 IoCs

Processes

  • C:\Windows\system32\cmd.exe
    cmd /c "C:\Users\Admin\AppData\Local\Temp\ffdec.bat"
    1⤵
    • Suspicious use of WriteProcessMemory
    PID:632
    • C:\Windows\system32\java.exe
      java -Xmx1024m -Djna.nosys=true -jar "C:\Users\Admin\AppData\Local\Temp\\ffdec.jar"
      2⤵
        PID:2052

    Network

    MITRE ATT&CK Matrix

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    • memory/2052-2-0x0000000002590000-0x0000000002800000-memory.dmp

      Filesize

      2.4MB

    • memory/2052-11-0x0000000000140000-0x0000000000141000-memory.dmp

      Filesize

      4KB

    • memory/2052-12-0x0000000002590000-0x0000000002800000-memory.dmp

      Filesize

      2.4MB