782288f03f7041a5d43e4da7bd915f5194eb78454230091fa54f9bcf15352f5b | Triage

Analysis

max time kernel
139s
max time network
123s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
18/10/2024, 09:01

Sharing

Report Analysis Logs

General

Target

After Effects CS4 Crack/patch.cmd
Size

167B
MD5

e0e765e1cf617d76cadd5d61a042c1a7
SHA1

9def9e2a2b1c74c704a82b5413d7cea69c57ef4f
SHA256

6663bbebdcf7e4c1163a7e69cd20404d7820d13e50c0d1eceb2dfcb3908f26ae
SHA512

27b46ff46859d15730468bd391ea46fc93d4388f1bb77848fd8ae4585594be4b91e5d4ce161f5f5c127c8ff45e2617f4c9788b51b02cfff663e7955a0fe9e9f5

Score

8^/10

Malware Config

Signatures

Drops file in Drivers directory 1 IoCs

description	ioc	Process
File opened for modification	C:\Windows\system32\drivers\etc\hosts	cmd.exe

Suspicious use of WriteProcessMemory 2 IoCs

description	pid	Process	procid_target
PID 2448 wrote to memory of 492	2448	cmd.exe	85
PID 2448 wrote to memory of 492	2448	cmd.exe	85

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\After Effects CS4 Crack\patch.cmd"
1⤵
- Drops file in Drivers directory
- Suspicious use of WriteProcessMemory
PID:2448
- C:\Windows\system32\find.exe
  FIND /C /I "activate.adobe.com" C:\Windows\system32\drivers\etc\hosts
  2⤵
  PID:492

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads