16ed4d228a5113fce098e69d4471b0e5829797882ac3bb5b19c61277fda25b02 | Triage

Analysis

max time kernel
117s
max time network
118s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
20-09-2024 20:55

Sharing

Report Analysis Logs

General

Target

main.bat
Size

72KB
MD5

9f14d8dad3856dfa4e9de47c35384059
SHA1

df9fc4c4ef86d9652495b80f8b78043692cd41db
SHA256

16ed4d228a5113fce098e69d4471b0e5829797882ac3bb5b19c61277fda25b02
SHA512

b2fb7562cc0819fe2bd0c4fbe16d10b44f112a11b7a0a7f097f4f0d61c5c1770b2ddb2ffa08fdc5b14a7603c0e2f10fa2dd445b7e23eeb55a98d8bd535f53d4d
SSDEEP

768:IposY9qsaIZz+QK7ruEDHs2guEDHsaOmh82mnUjQxOn1TS6QeQg+mispepU:ICsYOBm9mnUk01SeQg+miU

Score

1^/10

Malware Config

Signatures

Suspicious use of WriteProcessMemory 6 IoCs

description	pid	Process	procid_target
PID 2904 wrote to memory of 2388	2904	cmd.exe	31
PID 2904 wrote to memory of 2388	2904	cmd.exe	31
PID 2904 wrote to memory of 2388	2904	cmd.exe	31
PID 2904 wrote to memory of 2404	2904	cmd.exe	32
PID 2904 wrote to memory of 2404	2904	cmd.exe	32
PID 2904 wrote to memory of 2404	2904	cmd.exe	32

C:\Windows\system32\cmd.exe
cmd /c "C:\Users\Admin\AppData\Local\Temp\main.bat"
1⤵
- Suspicious use of WriteProcessMemory
PID:2904
- C:\Windows\system32\chcp.com
  chcp 65001
  2⤵
  PID:2388
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c "prompt $H &echo on &for %B in (1) do rem"
  2⤵
  PID:2404

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads