d3a307d6c9237b888e40f7ed3a3b590eefc1f9f9739740b03de99c1da56753c2

Analysis

max time kernel
92s
max time network
94s
platform
windows11-21h2_x64
resource
win11-20241007-en
resource tags

arch:x64arch:x86image:win11-20241007-enlocale:en-usos:windows11-21h2-x64system
submitted
21-11-2024 00:32

Target

input lag and system config/Special Enhencer by f4fix.bat
Size

1KB
MD5

6771ae4d53a4086608e5ebbafdd2b517
SHA1

5d0dd323a475d5194d39c07ece070491a5b2f453
SHA256

fdf815878a1184d9e8507530011195831950ea46644a8e3767c2cfd7f902af69
SHA512

478de8a31e192a6541670db073d350cbc9a9e56567b3eccc99de6d4d4b9cd9a1e056d04309266bbdc857ada97bb0727467e22e1bcb43234e09520812c24bdd1b

Score

1^/10

Modifies registry key 1 TTPs 1 IoCs

Modify Registry

pid	Process
1584	reg.exe

Suspicious use of WriteProcessMemory 2 IoCs

description	pid	Process	procid_target
PID 3740 wrote to memory of 1584	3740	cmd.exe	79
PID 3740 wrote to memory of 1584	3740	cmd.exe	79

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\input lag and system config\Special Enhencer by f4fix.bat"
1⤵
- Suspicious use of WriteProcessMemory
PID:3740
- C:\Windows\system32\reg.exe
  Reg Add HKCU\Software\Microsoft\Windows\CurrentVersion\BackgroundAccessApplications /v GlobalUserDisabled /t REG_DWORD /d 1 /f
  2⤵
  - Modifies registry key
  PID:1584

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact