6b9b0c2be545dc060c19760fb7437a2661c50797797faa167a4b00a9236d4f29 | Triage

Analysis

max time kernel
121s
max time network
141s
platform
windows7_x64
resource
win7-20240611-en
resource tags

arch:x64arch:x86image:win7-20240611-enlocale:en-usos:windows7-x64system
submitted
30-06-2024 06:36

Sharing

Report Analysis Logs

General

Target

HBCD/WinTools/ContentAdvisorPasswordRemover.bat
Size

105B
MD5

a2c4cb3f9f4a6a0a7a9a25ae2cb9e6b3
SHA1

522dca9ecafe66612808982640ce89fe3b8f6cc2
SHA256

9b7619aa1966f1765dd7b271881fff2a21fa446fd8f0ea29281df7809807ad2d
SHA512

21c172f4afcc5a86d35646971c43453d4e08d3dac94e7f65bd7de1b094f674ab56b86eaa2fcab55b44d42bae5f4b930742066dfcf3097eec5c3d98134e3230d1

Score

7^/10

Malware Config

Signatures

UPX packed file 2 IoCs
Detects executables packed with UPX/modified UPX open source packer.
upx

Processes:

resource yara_rule

behavioral17/memory/1036-0-0x0000000000400000-0x000000000047D000-memory.dmp upx
behavioral17/memory/1036-4-0x0000000000400000-0x000000000047D000-memory.dmp upx
Suspicious behavior: CmdExeWriteProcessMemorySpam 1 IoCs

Processes:

uharc.exe

pid process

1036 uharc.exe

Suspicious use of WriteProcessMemory 4 IoCs

Processes:

cmd.exe

description	pid	process	target process
PID 2572 wrote to memory of 1036	2572	cmd.exe	uharc.exe
PID 2572 wrote to memory of 1036	2572	cmd.exe	uharc.exe
PID 2572 wrote to memory of 1036	2572	cmd.exe	uharc.exe
PID 2572 wrote to memory of 1036	2572	cmd.exe	uharc.exe

C:\Windows\system32\cmd.exe
cmd /c "C:\Users\Admin\AppData\Local\Temp\HBCD\WinTools\ContentAdvisorPasswordRemover.bat"
1⤵
- Suspicious use of WriteProcessMemory
PID:2572

C:\Users\Admin\AppData\Local\Temp\HBCD\uharc.exe
..\uharc.exe x -t"C:\Users\Admin\AppData\Local\Temp" -y+ files\files.uha contpass.exe
2⤵
- Suspicious behavior: CmdExeWriteProcessMemorySpam
PID:1036

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1036-0-0x0000000000400000-0x000000000047D000-memory.dmp

Filesize
500KB

Download
memory/1036-4-0x0000000000400000-0x000000000047D000-memory.dmp

Filesize
500KB

Download