Automated Malware Analysis IOC Report for

Path

Cmdline

Malicious

C:\Windows\System32\cmd.exe

"C:\Windows\System32\cmd.exe" /c "SPASTICS\STYRACIN.CMD reg" i Monoeidic X Sortieing

Details

Is windows:	true
Is dropped:	false
PID:	1804
Target ID:	0
Parent PID:	3528
Name:	cmd.exe
Class:	cmd
Path:	C:\Windows\System32\cmd.exe
Commandline:	"C:\Windows\System32\cmd.exe" /c "SPASTICS\STYRACIN.CMD reg" i Monoeidic X Sortieing
Size:	273920
MD5:	4E2ACF4F8A396486AB4268C94A6A245F
Time:	07:52:06
Date:	01/02/2023
Reason:	newprocess
Reputation:	high
Is admin:	true
Is elevated:	true
Modulebase:	0x7ff632260000
Modulesize:	405504
Wow64:	false

Signature Hits	Behavior Group	Mitre Attack
Windows shortcut file (LNK) starts blacklisted processes	Persistence and Installation Behavior	Process Discovery
Spawns processes	System Summary	Process Injection

C:\Windows\System32\conhost.exe

C:\Windows\system32\conhost.exe 0xffffffff -ForceV1

Details

Is windows:	true
Is dropped:	false
PID:	5264
Target ID:	1
Parent PID:	1804
Name:	conhost.exe
Path:	C:\Windows\System32\conhost.exe
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Size:	625664
MD5:	EA777DEEA782E8B4D7C7C33BBF8A4496
Time:	07:52:06
Date:	01/02/2023
Reason:	newprocess
Reputation:	high
Is admin:	true
Is elevated:	true
Modulebase:	0x7ff7c72c0000
Modulesize:	651264
Wow64:	false

Signature Hits	Behavior Group	Mitre Attack
Spawns processes	System Summary	Process Injection

Domain

Country

Malicious

192.168.2.1

unknown

IOC Report
DECIDENT.LNK.lnk