ad28a59e2234cee44a0eee96aff1c7a71054a40734d289fe0d436e79247ad6d3 | Triage

Analysis

max time kernel
125s
max time network
132s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
01/10/2024, 01:14

Sharing

Report Analysis Logs

General

Target

AMI/spoof.bat
Size

57B
MD5

70c372a580ee13ad16ff67d3cc0ff0c6
SHA1

7e92af45a827b70404573f9f8339b2c9297793ec
SHA256

74975bffd064e9e27f44db7738b5f4c971ca1401b5e5d89f4aa50835801abb5c
SHA512

8dd0f5cbf1e66061f11d9129b6da90046ffc36742b2884e271399f17f096dbaf5c1db80d2b4c3e4594961021c96e04c623c684c5c6511cfe6e64b5527d1e50ed

Score

1^/10

Malware Config

Signatures

Suspicious behavior: LoadsDriver 1 IoCs

pid	Process
660	Process not Found

Suspicious use of WriteProcessMemory 2 IoCs

description	pid	Process	procid_target
PID 3316 wrote to memory of 220	3316	cmd.exe	90
PID 3316 wrote to memory of 220	3316	cmd.exe	90

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\AMI\spoof.bat"
1⤵
- Suspicious use of WriteProcessMemory
PID:3316
- C:\Users\Admin\AppData\Local\Temp\AMI\AMIDEWINx64.EXE
  AMIDEWINx64.exe /SU AUTO
  2⤵
  PID:220

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --field-trial-handle=4288,i,5469445176230119590,7931734017267321834,262144 --variations-seed-version --mojo-platform-channel-handle=3988 /prefetch:8
1⤵
PID:4808

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads