IOC Report
Fake!Virus!HarmlessAHAHHA.bat

loading gif

Files

File Path
Type
Category
Malicious
Fake!Virus!HarmlessAHAHHA.bat
DOS batch file, ASCII text, with CRLF line terminators
initial sample
 malicious
\Device\Null
ASCII text, with CRLF line terminators
dropped

Processes

Path
Cmdline
Malicious
C:\Windows\System32\cmd.exe
C:\Windows\system32\cmd.exe /c ""C:\Users\user\Desktop\Fake!Virus!HarmlessAHAHHA.bat" "
 malicious
C:\Windows\System32\PING.EXE
ping -n 2 127.0.0.1
 malicious
C:\Windows\System32\PING.EXE
ping -n 3 127.0.0.1
 malicious
C:\Windows\System32\PING.EXE
ping -n 4 127.0.0.1
 malicious
C:\Windows\System32\PING.EXE
ping -n 5 127.0.0.1
 malicious
C:\Windows\System32\PING.EXE
ping -n 3 127.0.0.1
 malicious
C:\Windows\System32\PING.EXE
ping -n 4 127.0.0.1
 malicious
C:\Windows\System32\PING.EXE
ping -n 5 127.0.0.1
 malicious
C:\Windows\System32\PING.EXE
ping -n 2 127.0.0.1
 malicious
C:\Windows\System32\PING.EXE
ping -n 2 127.0.0.1
 malicious
C:\Windows\System32\PING.EXE
ping -n 2 127.0.0.1
 malicious
C:\Windows\System32\PING.EXE
ping -n 2 127.0.0.1
 malicious
C:\Windows\System32\PING.EXE
ping -n 2 127.0.0.1
 malicious
C:\Windows\System32\conhost.exe
C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
C:\Windows\System32\mode.com
mode con: cols=80 lines=25
There are 5 hidden processes, click here to show them.

IPs

IP
Domain
Country
Malicious
127.0.0.1
unknown
unknown
malicious

Memdumps

Base Address
Regiontype
Protect
Malicious
19702C3E000
heap
page read and write
19702C10000
heap
page read and write
1595DFF000
stack
page read and write
1595CFE000
stack
page read and write
19702E00000
heap
page read and write
19702E20000
heap
page read and write
19702F25000
heap
page read and write
19702C39000
heap
page read and write
1595D7D000
stack
page read and write
19702C30000
heap
page read and write
1595C7C000
stack
page read and write
19702F20000
heap
page read and write
There are 2 hidden memdumps, click here to show them.