6da8bd1c06f2f2ef79cedecb574c961265bf11ad87e62b7767e55b4b42f3145d | Triage

Analysis

max time kernel
125s
max time network
131s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
25/09/2024, 10:08

Sharing

Report Analysis Logs

General

Target

卸载.bat
Size

1KB
MD5

e098a4d2fcec16931e0ae4e3e5159017
SHA1

3d65b7b91d3d87d2947b94559953a39e81893f96
SHA256

610bb0d96423af0d79400d20b9ce964003a8336cfd0124d601da88d52e4f0488
SHA512

796191969692729d0c06f221d1fd336a49f2af27bfe3792905e99d493549ffc867f92a59f52c9880b92b45546c114cc7f71defb2609e0a50c50625d5991f6f81

Score

1^/10

Malware Config

Signatures

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 3996 wrote to memory of 2248	3996	cmd.exe	90
PID 3996 wrote to memory of 2248	3996	cmd.exe	90
PID 3996 wrote to memory of 4580	3996	cmd.exe	91
PID 3996 wrote to memory of 4580	3996	cmd.exe	91

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\卸载.bat"
1⤵
- Suspicious use of WriteProcessMemory
PID:3996
- C:\Windows\system32\mode.com
  mode con cols=71 lines=18
  2⤵
  PID:2248
- C:\Windows\system32\regsvr32.exe
  regsvr32 /u /s ▒│╛░╫┼╔½╣ñ╛▀═Ω├└░µ3.1.dll
  2⤵
  PID:4580

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --field-trial-handle=4280,i,10065386245627775856,6567048529106473151,262144 --variations-seed-version --mojo-platform-channel-handle=1436 /prefetch:8
1⤵
PID:1748

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads