6b9b0c2be545dc060c19760fb7437a2661c50797797faa167a4b00a9236d4f29 | Triage

Analysis

max time kernel
121s
max time network
127s
platform
windows7_x64
resource
win7-20240508-en
resource tags

arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system
submitted
30-06-2024 06:36

Sharing

Report Analysis Logs

General

Target

HBCD/WinTools/DisableCompressOldFiles.bat
Size

280B
MD5

0741bc520a918d9e2af36404c088f380
SHA1

23d5d362d2f46c73e80bdd130f7720d918f07175
SHA256

35b0d4a202a43e594d729bc596afd96822c6c758644e9d3596c42e2940487e60
SHA512

b04964645119315800b966744a43f2842b02175fcb40bbdf9f100079b0ff9c0dcc79676aa08d48f2e825c883b89fdb070e591c4c7b8d1099bc523911f206dd68

Score

1^/10

Malware Config

Signatures

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

cmd.exe

description pid process target process

PID 2596 wrote to memory of 1320 2596 cmd.exe reg.exe
PID 2596 wrote to memory of 1320 2596 cmd.exe reg.exe
PID 2596 wrote to memory of 1320 2596 cmd.exe reg.exe

C:\Windows\system32\cmd.exe
cmd /c "C:\Users\Admin\AppData\Local\Temp\HBCD\WinTools\DisableCompressOldFiles.bat"
1⤵
- Suspicious use of WriteProcessMemory
PID:2596

C:\Windows\system32\reg.exe
REG DELETE "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\VolumeCaches\Compress old files"
2⤵
PID:1320

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...