Analysis

  • max time kernel
    93s
  • max time network
    96s
  • platform
    windows11-21h2_x64
  • resource
    win11-20241007-en
  • resource tags

    arch:x64arch:x86image:win11-20241007-enlocale:en-usos:windows11-21h2-x64system
  • submitted
    01-12-2024 18:51

General

  • Target

    MsSavesSessionDll/9KjI6fqbs0yhjc5d8qYY.bat

  • Size

    154B

  • MD5

    24c4210b146054c31eb1f4e01f0f4005

  • SHA1

    340eb576f0bc822344328fa3edf6638a60124381

  • SHA256

    bf807e7bc8dbbebecd7a334f77b9a0b0eec352846fd673bdeab482642002ae2f

  • SHA512

    46554f3f2441374a05ceee70c477aed58717f4e7e05ab57daa494f38a8f2b67b2f462a4a170bf4d3c54340d689934ca38462ee77299bca84cfdd0a7fe07dfa92

Score
8/10

Malware Config

Signatures

  • Disables Task Manager via registry modification
  • Modifies registry key 1 TTPs 1 IoCs
  • Suspicious use of WriteProcessMemory 2 IoCs

Processes

  • C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\MsSavesSessionDll\9KjI6fqbs0yhjc5d8qYY.bat"
    1⤵
    • Suspicious use of WriteProcessMemory
    PID:3872
    • C:\Windows\system32\reg.exe
      reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\System /v DisableTaskMgr /t REG_DWORD /d 1 /f
      2⤵
      • Modifies registry key
      PID:4296

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads