a6e96840029b64d72ddfd94ede969f521e1c05b91d5c23eee56b66afae6800c0 | Triage

Analysis

max time kernel
118s
max time network
119s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
08-11-2024 02:38

Sharing

Report Analysis Logs

General

Target

$_39_/bnn.bat
Size

146B
MD5

0b4d87168954eff0d213d2785fce723a
SHA1

79944843aba1c4ea95083026845552648a18f197
SHA256

b2d3e4c0e7d1c0a3d1308df4673e971246356c7b7e11885a2b9631ecac828b65
SHA512

9518c8af4c9870f058b57d97723581e979ebaa69478cd6b7ad9837cbdc84b75bc848019781aa9d20d498df6871833651f5c79e3d5da2e917a435cce71c8d0cc4

Score

1^/10

Malware Config

Signatures

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2844 wrote to memory of 1340	2844	cmd.exe	32
PID 2844 wrote to memory of 1340	2844	cmd.exe	32
PID 2844 wrote to memory of 1340	2844	cmd.exe	32

C:\Windows\system32\cmd.exe
cmd /c "C:\Users\Admin\AppData\Local\Temp\$_39_\bnn.bat"
1⤵
- Suspicious use of WriteProcessMemory
PID:2844
- C:\Windows\system32\reg.exe
  reg add "HKCU\SOFTWARE\Policies\Microsoft\Edge" /v "SmartScreenEnabled" /t reg_DWORD /d 0 /f
  2⤵
  PID:1340

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads