6da8bd1c06f2f2ef79cedecb574c961265bf11ad87e62b7767e55b4b42f3145d | Triage

Analysis

max time kernel
122s
max time network
126s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
25/09/2024, 10:08

Sharing

Report Analysis Logs

General

Target

安装.bat
Size

1KB
MD5

5be68779449563b7e43848fa45301b85
SHA1

d5d0abb284936fbde900dcddc25ebcdb2648eb8c
SHA256

48638a565ffd649536b6b059e1e02574a0996153899a843521bffc79c561dcc9
SHA512

ec646d755d7165aee55b9141ee2e6433d89778e26ea445838011f66dedea8c0cb2c18d27ea497e545ca3b2a26f008e43f542175a9a39d78ff2c7ccd281b46879

Score

1^/10

Malware Config

Signatures

Suspicious behavior: CmdExeWriteProcessMemorySpam 1 IoCs

pid	Process
1632	regsvr32.exe

Suspicious use of WriteProcessMemory 8 IoCs

description	pid	Process	procid_target
PID 1352 wrote to memory of 1928	1352	cmd.exe	31
PID 1352 wrote to memory of 1928	1352	cmd.exe	31
PID 1352 wrote to memory of 1928	1352	cmd.exe	31
PID 1352 wrote to memory of 1632	1352	cmd.exe	32
PID 1352 wrote to memory of 1632	1352	cmd.exe	32
PID 1352 wrote to memory of 1632	1352	cmd.exe	32
PID 1352 wrote to memory of 1632	1352	cmd.exe	32
PID 1352 wrote to memory of 1632	1352	cmd.exe	32

C:\Windows\system32\cmd.exe
cmd /c "C:\Users\Admin\AppData\Local\Temp\安装.bat"
1⤵
- Suspicious use of WriteProcessMemory
PID:1352
- C:\Windows\system32\mode.com
  mode con cols=71 lines=18
  2⤵
  PID:1928
- C:\Windows\system32\regsvr32.exe
  regsvr32 /s ▒│╛░╫┼╔½╣ñ╛▀═Ω├└░µ3.1.dll
  2⤵
  - Suspicious behavior: CmdExeWriteProcessMemorySpam
  PID:1632

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads