2f7c4001b496b4bb53c75014f83a55bb7cdf06254806f5cd4591c5af4e146de7

Analysis

max time kernel
121s
max time network
122s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
11/03/2025, 02:38

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

RFQ_PO_783B65/RFQ-PO783B65.bat
Size

45B
MD5

c15f0bc7c754ae5cc5f09d4a646232a5
SHA1

3463cfed84c507ea4839793db9a19b79d9218632
SHA256

1d25f7af62786393a933913bcbd4e0412b7261817ecea3aeb60e2294adaece9d
SHA512

bf5c3da788c3807d8be313765f12671cc67bac797214d7a18ab1570c6fbcbb4a8536ec169633329d51d22b087692ebfed45fd8565277a4c26df656ab6e9e43f0

Score

7^/10

Malware Config

Signatures

Drops startup file 1 IoCs

description	ioc	Process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\microsofts.vbs	RFQ-PO783B65.png

Suspicious behavior: EnumeratesProcesses 1 IoCs

pid	Process
3004	RFQ-PO783B65.png

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	3004	RFQ-PO783B65.png
Token: SeDebugPrivilege	3004	RFQ-PO783B65.png

Suspicious use of WriteProcessMemory 6 IoCs

description	pid	Process	procid_target
PID 2376 wrote to memory of 3004	2376	cmd.exe	32
PID 2376 wrote to memory of 3004	2376	cmd.exe	32
PID 2376 wrote to memory of 3004	2376	cmd.exe	32
PID 3004 wrote to memory of 4624	3004	RFQ-PO783B65.png	33
PID 3004 wrote to memory of 4624	3004	RFQ-PO783B65.png	33
PID 3004 wrote to memory of 4624	3004	RFQ-PO783B65.png	33

C:\Windows\system32\cmd.exe
cmd /c "C:\Users\Admin\AppData\Local\Temp\RFQ_PO_783B65\RFQ-PO783B65.bat"
1⤵
- Suspicious use of WriteProcessMemory
PID:2376
- C:\Users\Admin\AppData\Local\Temp\RFQ_PO_783B65\RFQ-PO783B65.png
  "RFQ-PO783B65.png"
  2⤵
  - Drops startup file
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:3004
- - C:\Windows\system32\WerFault.exe
    C:\Windows\system32\WerFault.exe -u -p 3004 -s 596
    3⤵
    PID:4624

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/3004-0-0x000007FEF5C83000-0x000007FEF5C84000-memory.dmp

Filesize
4KB

Download
memory/3004-1-0x0000000000150000-0x000000000026C000-memory.dmp

Filesize
1.1MB

Download
memory/3004-2-0x000000001BD80000-0x000000001BE86000-memory.dmp

Filesize
1.0MB

Download
memory/3004-3-0x000007FEF5C80000-0x000007FEF666C000-memory.dmp

Filesize
9.9MB

Download
memory/3004-4-0x000000001BD80000-0x000000001BE80000-memory.dmp

Filesize
1024KB

Download
memory/3004-5-0x000000001BD80000-0x000000001BE80000-memory.dmp

Filesize
1024KB

Download
memory/3004-7-0x000000001BD80000-0x000000001BE80000-memory.dmp

Filesize
1024KB

Download
memory/3004-9-0x000000001BD80000-0x000000001BE80000-memory.dmp

Filesize
1024KB

Download
memory/3004-11-0x000000001BD80000-0x000000001BE80000-memory.dmp

Filesize
1024KB

Download
memory/3004-17-0x000000001BD80000-0x000000001BE80000-memory.dmp

Filesize
1024KB

Download
memory/3004-19-0x000000001BD80000-0x000000001BE80000-memory.dmp

Filesize
1024KB

Download
memory/3004-15-0x000000001BD80000-0x000000001BE80000-memory.dmp

Filesize
1024KB

Download
memory/3004-13-0x000000001BD80000-0x000000001BE80000-memory.dmp

Filesize
1024KB

Download
memory/3004-21-0x000000001BD80000-0x000000001BE80000-memory.dmp

Filesize
1024KB

Download
memory/3004-27-0x000000001BD80000-0x000000001BE80000-memory.dmp

Filesize
1024KB

Download
memory/3004-43-0x000000001BD80000-0x000000001BE80000-memory.dmp

Filesize
1024KB

Download
memory/3004-65-0x000000001BD80000-0x000000001BE80000-memory.dmp

Filesize
1024KB

Download
memory/3004-23-0x000000001BD80000-0x000000001BE80000-memory.dmp

Filesize
1024KB

Download
memory/3004-67-0x000000001BD80000-0x000000001BE80000-memory.dmp

Filesize
1024KB

Download
memory/3004-63-0x000000001BD80000-0x000000001BE80000-memory.dmp

Filesize
1024KB

Download
memory/3004-61-0x000000001BD80000-0x000000001BE80000-memory.dmp

Filesize
1024KB

Download
memory/3004-59-0x000000001BD80000-0x000000001BE80000-memory.dmp

Filesize
1024KB

Download
memory/3004-57-0x000000001BD80000-0x000000001BE80000-memory.dmp

Filesize
1024KB

Download
memory/3004-55-0x000000001BD80000-0x000000001BE80000-memory.dmp

Filesize
1024KB

Download
memory/3004-53-0x000000001BD80000-0x000000001BE80000-memory.dmp

Filesize
1024KB

Download
memory/3004-51-0x000000001BD80000-0x000000001BE80000-memory.dmp

Filesize
1024KB

Download
memory/3004-49-0x000000001BD80000-0x000000001BE80000-memory.dmp

Filesize
1024KB

Download
memory/3004-47-0x000000001BD80000-0x000000001BE80000-memory.dmp

Filesize
1024KB

Download
memory/3004-45-0x000000001BD80000-0x000000001BE80000-memory.dmp

Filesize
1024KB

Download
memory/3004-41-0x000000001BD80000-0x000000001BE80000-memory.dmp

Filesize
1024KB

Download
memory/3004-39-0x000000001BD80000-0x000000001BE80000-memory.dmp

Filesize
1024KB

Download
memory/3004-37-0x000000001BD80000-0x000000001BE80000-memory.dmp

Filesize
1024KB

Download
memory/3004-35-0x000000001BD80000-0x000000001BE80000-memory.dmp

Filesize
1024KB

Download
memory/3004-33-0x000000001BD80000-0x000000001BE80000-memory.dmp

Filesize
1024KB

Download
memory/3004-31-0x000000001BD80000-0x000000001BE80000-memory.dmp

Filesize
1024KB

Download
memory/3004-29-0x000000001BD80000-0x000000001BE80000-memory.dmp

Filesize
1024KB

Download
memory/3004-25-0x000000001BD80000-0x000000001BE80000-memory.dmp

Filesize
1024KB

Download
memory/3004-1326-0x000007FEF5C80000-0x000007FEF666C000-memory.dmp

Filesize
9.9MB

Download
memory/3004-1327-0x00000000009E0000-0x0000000000A40000-memory.dmp

Filesize
384KB

Download
memory/3004-1328-0x0000000002300000-0x000000000235C000-memory.dmp

Filesize
368KB

Download
memory/3004-1329-0x000007FEF5C80000-0x000007FEF666C000-memory.dmp

Filesize
9.9MB

Download
memory/3004-1330-0x0000000002400000-0x000000000244C000-memory.dmp

Filesize
304KB

Download
memory/3004-1331-0x000007FEF5C80000-0x000007FEF666C000-memory.dmp

Filesize
9.9MB

Download
memory/3004-1332-0x000007FEF5C83000-0x000007FEF5C84000-memory.dmp

Filesize
4KB

Download
memory/3004-1333-0x000007FEF5C80000-0x000007FEF666C000-memory.dmp

Filesize
9.9MB

Download
memory/3004-1334-0x000007FEF5C80000-0x000007FEF666C000-memory.dmp

Filesize
9.9MB

Download
memory/3004-1335-0x000007FEF5C80000-0x000007FEF666C000-memory.dmp

Filesize
9.9MB

Download
memory/3004-1336-0x000007FEF5C80000-0x000007FEF666C000-memory.dmp

Filesize
9.9MB

Download
memory/3004-1337-0x0000000002450000-0x00000000024A4000-memory.dmp

Filesize
336KB

Download
memory/3004-1340-0x000007FEF5C80000-0x000007FEF666C000-memory.dmp

Filesize
9.9MB

Download
memory/3004-1341-0x000007FEF5C80000-0x000007FEF666C000-memory.dmp

Filesize
9.9MB

Download