f15a78efd211bae6dd492d449beeb3844bd758a5241cfa48d0fd19dbe766102d | Triage

Analysis

max time kernel
119s
max time network
121s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
26-01-2025 00:53

Sharing

Report Analysis Logs

General

Target

perm/mac/spoof.bat
Size

75B
MD5

0072872258bb8e64d260120fcd784355
SHA1

e3b9ce3df6aa5b69c6a81c72a54811a6d126ae48
SHA256

6a23eab15d38c1769a2c33aae71b6a66713244fe453e1e864c75866bc5e25463
SHA512

52885e141c2df46c0ab46f6673dee31d6c302bd058647aee73ce6e5209caf7cec4caf4780789d60eaedf5647f3be68dda32634d5fa751150e3ab8b797baf56a1

Score

1^/10

Malware Config

Signatures

Suspicious behavior: LoadsDriver 1 IoCs

pid	Process
472	Process not Found

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2100 wrote to memory of 2404	2100	cmd.exe	31
PID 2100 wrote to memory of 2404	2100	cmd.exe	31
PID 2100 wrote to memory of 2404	2100	cmd.exe	31

C:\Windows\system32\cmd.exe
cmd /c "C:\Users\Admin\AppData\Local\Temp\perm\mac\spoof.bat"
1⤵
- Suspicious use of WriteProcessMemory
PID:2100
- C:\Users\Admin\AppData\Local\Temp\perm\mac\RealTek_flash.exe
  RealTek_flash.exe /# 1 /EFUSE /NODEID "0215230B93DE"
  2⤵
  PID:2404

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads