Resubmissions

30/10/2024, 16:49

241030-vbwvwsxgrq 10

29/10/2024, 09:34

241029-ljtk3atgnl 10

28/10/2024, 21:00

241028-ztbpwsxepl 10

28/10/2024, 19:58

241028-yp33xatnbx 10

28/10/2024, 15:14

241028-smb9hssdqq 10

28/10/2024, 12:21

241028-pjecxswrbq 10

28/10/2024, 10:35

241028-mm35cavlet 10

28/10/2024, 10:29

241028-mjle5avkf1 10

27/10/2024, 22:14

241027-15tkhsvarn 10

27/10/2024, 17:07

241027-vm41mszdjd 10

Analysis

  • max time kernel
    300s
  • max time network
    305s
  • platform
    windows10-ltsc 2021_x64
  • resource
    win10ltsc2021-20241023-en
  • resource tags

    arch:x64arch:x86image:win10ltsc2021-20241023-enlocale:en-usos:windows10-ltsc 2021-x64system
  • submitted
    27/10/2024, 16:24

General

  • Target

    PUB2/zephyr - Copie (9).bat

  • Size

    168B

  • MD5

    ba22652cd85191f4cc7e21db61e2bd71

  • SHA1

    aece18a53876615b26eea19ad30409a447a5a8f6

  • SHA256

    4d4148fe8ab2368aaa811877b31d759d09b07df189587fed822d1011aca79a88

  • SHA512

    df0cef76781eef6be0ada6fc8ca56de463d11c8b068ff0af2465dc97e05d910e5b9f10ecd95e9c0fd005ff8236cf52d2ea8f9de899dc7defceb3057c08a900a8

Score
1/10

Malware Config

Signatures

  • Suspicious use of AdjustPrivilegeToken 2 IoCs
  • Suspicious use of FindShellTrayWindow 1 IoCs
  • Suspicious use of WriteProcessMemory 2 IoCs

Processes

  • C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\PUB2\zephyr - Copie (9).bat"
    1⤵
    • Suspicious use of WriteProcessMemory
    PID:4840
    • C:\Users\Admin\AppData\Local\Temp\PUB2\xmrig.exe
      xmrig.exe -o us-zephyr.miningocean.org:5342 -u ZEPHYR2c1KpUmMcFb1DgEejg8bgrit4x9L8TUEk2e7B7gbtwtHDVyKCUZEzu4zQMnGjgZjJZES6wnefC6FgLJeyL6Ahz2SsWsoK1Y -p scall -a rx/0 -k
      2⤵
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of FindShellTrayWindow
      PID:1256

Network

        MITRE ATT&CK Matrix

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        • memory/1256-0-0x00000202009D0000-0x00000202009F0000-memory.dmp

          Filesize

          128KB

        • memory/1256-1-0x00000202024E0000-0x0000020202500000-memory.dmp

          Filesize

          128KB

        • memory/1256-2-0x0000020202500000-0x0000020202520000-memory.dmp

          Filesize

          128KB

        • memory/1256-3-0x0000020202520000-0x0000020202540000-memory.dmp

          Filesize

          128KB

        • memory/1256-4-0x0000020202500000-0x0000020202520000-memory.dmp

          Filesize

          128KB

        • memory/1256-5-0x0000020202520000-0x0000020202540000-memory.dmp

          Filesize

          128KB