13101216127da473cec5dda480c23c4db57e1f1a9d25f46c7595818c30cf1f52

Analysis

max time kernel
117s
max time network
118s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
04-12-2024 13:57

Target

$_63_/bnn.bat
Size

599B
MD5

a77f19fdf07ee0bdcec8889e50953c81
SHA1

3bf08f4e5f0bc98cd9e370a2adc0111a37eb7c7f
SHA256

65a32afecedfad8e6979735e65db8ac64dc17048d930c5bc6036c62764e6a9a2
SHA512

ece9f684b8e081caf4aec6f1d1373a0931e27694beefa316f94771433d20418cd510443495b7a951f1ea14a8e585f442a5092bcb9dce6c73a73043c319149ff8

Score

1^/10

Suspicious use of WriteProcessMemory 15 IoCs

description	pid	Process	procid_target
PID 2168 wrote to memory of 2152	2168	cmd.exe	31
PID 2168 wrote to memory of 2152	2168	cmd.exe	31
PID 2168 wrote to memory of 2152	2168	cmd.exe	31
PID 2168 wrote to memory of 320	2168	cmd.exe	32
PID 2168 wrote to memory of 320	2168	cmd.exe	32
PID 2168 wrote to memory of 320	2168	cmd.exe	32
PID 2168 wrote to memory of 3052	2168	cmd.exe	33
PID 2168 wrote to memory of 3052	2168	cmd.exe	33
PID 2168 wrote to memory of 3052	2168	cmd.exe	33
PID 2168 wrote to memory of 2696	2168	cmd.exe	34
PID 2168 wrote to memory of 2696	2168	cmd.exe	34
PID 2168 wrote to memory of 2696	2168	cmd.exe	34
PID 2168 wrote to memory of 2428	2168	cmd.exe	35
PID 2168 wrote to memory of 2428	2168	cmd.exe	35
PID 2168 wrote to memory of 2428	2168	cmd.exe	35

C:\Windows\system32\cmd.exe
cmd /c "C:\Users\Admin\AppData\Local\Temp\$_63_\bnn.bat"
1⤵
- Suspicious use of WriteProcessMemory
PID:2168
- C:\Windows\system32\reg.exe
  reg add "HKLM\SOFTWARE\Policies\Microsoft\Internet Explorer\PhishingFilter" /v "PreventOverride" /t reg_DWORD /d 0 /f
  2⤵
  PID:2152
- C:\Windows\system32\reg.exe
  reg add "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer" /v "SmartScreenEnabled" /t reg_SZ /d "Off" /f
  2⤵
  PID:320
- C:\Windows\system32\reg.exe
  reg add "HKCU\SOFTWARE\Policies\Microsoft\Edge" /v "SmartScreenEnabled" /t reg_DWORD /d 0 /f
  2⤵
  PID:3052
- C:\Windows\system32\reg.exe
  reg add "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\AppHost" /v "SmartScreenEnabled" /t reg_SZ /d "Off" /f
  2⤵
  PID:2696
- C:\Windows\system32\reg.exe
  reg add "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\AppHost" /v "EnableWebContentEvaluation" /t reg_DWORD /d 0 /f
  2⤵
  PID:2428