Resubmissions

27/10/2024, 15:04

241027-sf193awngn 10

26/10/2024, 18:30

241026-w5nxtavncj 10

26/10/2024, 08:56

241026-kwfpassemh 10

26/10/2024, 03:43

241026-d92qcs1ajk 10

26/10/2024, 03:31

241026-d3dpysygqe 10

26/10/2024, 03:25

241026-dylj1aygme 10

Analysis

  • max time kernel
    300s
  • max time network
    301s
  • platform
    windows10-ltsc 2021_x64
  • resource
    win10ltsc2021-20241023-en
  • resource tags

    arch:x64arch:x86image:win10ltsc2021-20241023-enlocale:en-usos:windows10-ltsc 2021-x64system
  • submitted
    26/10/2024, 03:25

General

  • Target

    PUB2/zephyr - Copie.bat

  • Size

    168B

  • MD5

    ba22652cd85191f4cc7e21db61e2bd71

  • SHA1

    aece18a53876615b26eea19ad30409a447a5a8f6

  • SHA256

    4d4148fe8ab2368aaa811877b31d759d09b07df189587fed822d1011aca79a88

  • SHA512

    df0cef76781eef6be0ada6fc8ca56de463d11c8b068ff0af2465dc97e05d910e5b9f10ecd95e9c0fd005ff8236cf52d2ea8f9de899dc7defceb3057c08a900a8

Score
1/10

Malware Config

Signatures

  • Suspicious use of AdjustPrivilegeToken 2 IoCs
  • Suspicious use of FindShellTrayWindow 1 IoCs
  • Suspicious use of WriteProcessMemory 2 IoCs

Processes

  • C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\PUB2\zephyr - Copie.bat"
    1⤵
    • Suspicious use of WriteProcessMemory
    PID:1212
    • C:\Users\Admin\AppData\Local\Temp\PUB2\xmrig.exe
      xmrig.exe -o us-zephyr.miningocean.org:5342 -u ZEPHYR2c1KpUmMcFb1DgEejg8bgrit4x9L8TUEk2e7B7gbtwtHDVyKCUZEzu4zQMnGjgZjJZES6wnefC6FgLJeyL6Ahz2SsWsoK1Y -p scall -a rx/0 -k
      2⤵
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of FindShellTrayWindow
      PID:1508

Network

        MITRE ATT&CK Matrix

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        • memory/1508-0-0x0000022E871F0000-0x0000022E87210000-memory.dmp

          Filesize

          128KB

        • memory/1508-1-0x00007FFE129F0000-0x00007FFE12A8D000-memory.dmp

          Filesize

          628KB