Resubmissions

30/10/2024, 16:50

241030-vcdqpswpdw 10

30/10/2024, 16:50

241030-vcchmswpdv 10

30/10/2024, 16:50

241030-vcaztaxfka 10

30/10/2024, 16:50

241030-vb858ayper 10

30/10/2024, 16:49

241030-vb7bmaxfjh 10

30/10/2024, 16:49

241030-vb3cnsypem 10

29/10/2024, 09:34

241029-lj35hathjh 10

29/10/2024, 09:34

241029-lj35hasqgz 10

Analysis

  • max time kernel
    300s
  • max time network
    304s
  • platform
    windows10-ltsc 2021_x64
  • resource
    win10ltsc2021-20241023-en
  • resource tags

    arch:x64arch:x86image:win10ltsc2021-20241023-enlocale:en-usos:windows10-ltsc 2021-x64system
  • submitted
    27/10/2024, 16:23

General

  • Target

    PUB2/zephyr - Copie (3).bat

  • Size

    168B

  • MD5

    ba22652cd85191f4cc7e21db61e2bd71

  • SHA1

    aece18a53876615b26eea19ad30409a447a5a8f6

  • SHA256

    4d4148fe8ab2368aaa811877b31d759d09b07df189587fed822d1011aca79a88

  • SHA512

    df0cef76781eef6be0ada6fc8ca56de463d11c8b068ff0af2465dc97e05d910e5b9f10ecd95e9c0fd005ff8236cf52d2ea8f9de899dc7defceb3057c08a900a8

Score
1/10

Malware Config

Signatures

  • Suspicious use of AdjustPrivilegeToken 2 IoCs
  • Suspicious use of FindShellTrayWindow 1 IoCs
  • Suspicious use of WriteProcessMemory 2 IoCs

Processes

  • C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\PUB2\zephyr - Copie (3).bat"
    1⤵
    • Suspicious use of WriteProcessMemory
    PID:4024
    • C:\Users\Admin\AppData\Local\Temp\PUB2\xmrig.exe
      xmrig.exe -o us-zephyr.miningocean.org:5342 -u ZEPHYR2c1KpUmMcFb1DgEejg8bgrit4x9L8TUEk2e7B7gbtwtHDVyKCUZEzu4zQMnGjgZjJZES6wnefC6FgLJeyL6Ahz2SsWsoK1Y -p scall -a rx/0 -k
      2⤵
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of FindShellTrayWindow
      PID:1232

Network

        MITRE ATT&CK Matrix

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        • memory/1232-0-0x000001BC7B5D0000-0x000001BC7B5F0000-memory.dmp

          Filesize

          128KB

        • memory/1232-1-0x000001BC7D110000-0x000001BC7D130000-memory.dmp

          Filesize

          128KB

        • memory/1232-2-0x000001BC7D170000-0x000001BC7D190000-memory.dmp

          Filesize

          128KB

        • memory/1232-3-0x000001BC7D130000-0x000001BC7D150000-memory.dmp

          Filesize

          128KB

        • memory/1232-5-0x000001BC7D130000-0x000001BC7D150000-memory.dmp

          Filesize

          128KB

        • memory/1232-4-0x000001BC7D170000-0x000001BC7D190000-memory.dmp

          Filesize

          128KB