Resubmissions

30/10/2024, 16:49

241030-vb15lsxfje 10

29/10/2024, 09:34

241029-ljv4wsthjc 10

28/10/2024, 19:57

241028-ypl5dswcjd 10

28/10/2024, 15:23

241028-ssmmfazpd1 10

28/10/2024, 12:52

241028-p32mkaxlgq 10

28/10/2024, 12:42

241028-pxtprsxkeq 10

28/10/2024, 12:34

241028-prwl6sxke1 10

28/10/2024, 12:22

241028-pkep3sygpc 10

28/10/2024, 10:30

241028-mj7ncsxane 10

27/10/2024, 22:13

241027-144zvsteqb 10

Analysis

  • max time kernel
    300s
  • max time network
    280s
  • platform
    windows10-ltsc 2021_x64
  • resource
    win10ltsc2021-20241023-en
  • resource tags

    arch:x64arch:x86image:win10ltsc2021-20241023-enlocale:en-usos:windows10-ltsc 2021-x64system
  • submitted
    27/10/2024, 16:23

General

  • Target

    PUB2/zephyr - Copie (3).bat

  • Size

    168B

  • MD5

    ba22652cd85191f4cc7e21db61e2bd71

  • SHA1

    aece18a53876615b26eea19ad30409a447a5a8f6

  • SHA256

    4d4148fe8ab2368aaa811877b31d759d09b07df189587fed822d1011aca79a88

  • SHA512

    df0cef76781eef6be0ada6fc8ca56de463d11c8b068ff0af2465dc97e05d910e5b9f10ecd95e9c0fd005ff8236cf52d2ea8f9de899dc7defceb3057c08a900a8

Score
1/10

Malware Config

Signatures

  • Suspicious use of AdjustPrivilegeToken 2 IoCs
  • Suspicious use of FindShellTrayWindow 1 IoCs
  • Suspicious use of WriteProcessMemory 2 IoCs

Processes

  • C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\PUB2\zephyr - Copie (3).bat"
    1⤵
    • Suspicious use of WriteProcessMemory
    PID:1140
    • C:\Users\Admin\AppData\Local\Temp\PUB2\xmrig.exe
      xmrig.exe -o us-zephyr.miningocean.org:5342 -u ZEPHYR2c1KpUmMcFb1DgEejg8bgrit4x9L8TUEk2e7B7gbtwtHDVyKCUZEzu4zQMnGjgZjJZES6wnefC6FgLJeyL6Ahz2SsWsoK1Y -p scall -a rx/0 -k
      2⤵
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of FindShellTrayWindow
      PID:3460

Network

        MITRE ATT&CK Matrix

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        • memory/3460-0-0x0000015969480000-0x00000159694A0000-memory.dmp

          Filesize

          128KB

        • memory/3460-1-0x00007FFBCDD50000-0x00007FFBCDEAE000-memory.dmp

          Filesize

          1.4MB