Analysis

  • max time kernel
    1561s
  • max time network
    1563s
  • platform
    windows7_x64
  • resource
    win7-20240903-en
  • resource tags

    arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
  • submitted
    22-11-2024 02:21

General

  • Target

    360390_tree.cmd

  • Size

    15KB

  • MD5

    49163792f3b8c4f62018670033e9fc82

  • SHA1

    f2d8da51a9371cebc0fd41cb3d86f3768e791fae

  • SHA256

    4637c6b332d640450e7cb3ae6a6b0d7d4451454770699acf364d855e28805267

  • SHA512

    2fd7a02da20ca41c27b30f272bbf3bb186187492fc927a9dc8c7ea36b22c9e8ac6906428cab27eb7f907a21f352a2c7ed6ce60e48e0d9c35238a71ee8be6efad

  • SSDEEP

    192:iJCJ+JGJ6JaJeJWJSJSJeJ2J2bJ6JeJGJiJiJ+JmJ6JaJeJWJSJSJ05:iIU8Ao8Ug4UMcbYM0goUcAIcUg4C5

Malware Config

Signatures

Processes

  • C:\Windows\system32\cmd.exe
    cmd /c "C:\Users\Admin\AppData\Local\Temp\360390_tree.cmd"
    1⤵
    • Suspicious use of WriteProcessMemory
    PID:2256
    • C:\Windows\system32\notepad.exe
      notepad.exe C:\Users\ADMINI~1\AppData\Local\Temp\360390_readme.txt
      2⤵
        PID:2884
      • C:\Windows\system32\reg.exe
        REG ADD "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /V "WinHelp" /t REG_SZ /F /D "C:\Users\ADMINI~1\AppData\Local\Temp\360390_readme.txt"
        2⤵
        • Adds Run key to start application
        PID:2728

    Network

    MITRE ATT&CK Enterprise v15

    Replay Monitor

    Loading Replay Monitor...

    Downloads