6b9b0c2be545dc060c19760fb7437a2661c50797797faa167a4b00a9236d4f29 | Triage

Analysis

max time kernel
119s
max time network
124s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
30-06-2024 06:36

Sharing

Report Analysis Logs

General

Target

HBCD/WinTools/CPorts.bat
Size

101B
MD5

3ae8e6870c06a7415b230dddd3997680
SHA1

c1ff9787d53a7bd64019db22801ec34c432a0161
SHA256

fa57e4e2b976fa05052f14af7d8e291fb15a09ad99d1b5eeb552de02875e83eb
SHA512

152fabd1b301069b7a5674c94aae2343b48e7db6581e280f20bdcb9266d1f43c0534ba504a08d1673347b3eba99c700c167c7b8e1e7f75707c43dcc58780dbbb

Score

7^/10

Malware Config

Signatures

UPX packed file 2 IoCs
Detects executables packed with UPX/modified UPX open source packer.
upx

Processes:

resource yara_rule

behavioral13/memory/2332-0-0x0000000000400000-0x000000000047D000-memory.dmp upx
behavioral13/memory/2332-4-0x0000000000400000-0x000000000047D000-memory.dmp upx
Suspicious behavior: CmdExeWriteProcessMemorySpam 1 IoCs

Processes:

uharc.exe

pid process

2332 uharc.exe

Suspicious use of WriteProcessMemory 4 IoCs

Processes:

cmd.exe

description	pid	process	target process
PID 820 wrote to memory of 2332	820	cmd.exe	uharc.exe
PID 820 wrote to memory of 2332	820	cmd.exe	uharc.exe
PID 820 wrote to memory of 2332	820	cmd.exe	uharc.exe
PID 820 wrote to memory of 2332	820	cmd.exe	uharc.exe

C:\Windows\system32\cmd.exe
cmd /c "C:\Users\Admin\AppData\Local\Temp\HBCD\WinTools\CPorts.bat"
1⤵
- Suspicious use of WriteProcessMemory
PID:820

C:\Users\Admin\AppData\Local\Temp\HBCD\uharc.exe
..\uharc.exe x -t"C:\Users\Admin\AppData\Local\Temp" -y+ files\files.uha cports.exe
2⤵
- Suspicious behavior: CmdExeWriteProcessMemorySpam
PID:2332

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2332-0-0x0000000000400000-0x000000000047D000-memory.dmp

Filesize
500KB

Download
memory/2332-4-0x0000000000400000-0x000000000047D000-memory.dmp

Filesize
500KB

Download