Overview

overview

8

Static

static

8

Win32.Pega...15.xls

windows10_x64

1

Win32.Pega...15.xls

windows10_x64

1

Win32.Pega...?).doc

windows10_x64

1

Win32.Pega...15.doc

windows10_x64

1

Win32.Pega...min.js

windows10_x64

1

Win32.Pega...min.js

windows10_x64

1

Win32.Pega...ain.js

windows10_x64

1

Win32.Pega...ble.js

windows10_x64

1

Win32.Pega...min.js

windows10_x64

1

Win32.Pega...min.js

windows10_x64

1

Win32.Pega...min.js

windows10_x64

1

Win32.Pega...x.html

windows10_x64

1

Win32.Pega...vg.xml

windows10_x64

Win32.Pega...min.js

windows10_x64

1

Win32.Pega...hp.vbs

windows10_x64

1

Win32.Pega...hp.vbs

windows10_x64

1

Win32.Pega...hp.vbs

windows10_x64

1

Win32.Pega...php.js

windows10_x64

1

Win32.Pega...ol.exe

windows10_x64

1

Win32.Pega...gs.bat

windows10_x64

1

Win32.Pega...ct.bat

windows10_x64

1

Win32.Pega...es.bat

windows10_x64

1

Win32.Pega...re.bat

windows10_x64

1

Win32.Pega...er.bat

windows10_x64

1

Win32.Pega...er.bat

windows10_x64

1

Win32.Pega...hp.ps1

windows10_x64

Win32.Pega...RS.BAT

windows10_x64

1

Win32.Pega...ck.exe

windows10_x64

1

Win32.Pega...pp.vbs

windows10_x64

1

Win32.Pega...pp.vbs

windows10_x64

1

Win32.Pega...pp.vbs

windows10_x64

1

Win32.Pega...pp.vbs

windows10_x64

1

Analysis

  • max time kernel
    312s
  • max time network
    1002s
  • platform
    windows10_x64
  • resource
    win10v20210410
  • submitted
    23-07-2021 09:33

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    Win32.Pegasus/Pegasus/tools/rebuild_project.bat

  • Size

    1KB

  • MD5

    d002280de4163efce928e6cc365139d9

  • SHA1

    175b04108e8020b59e8ade1f9a476515bbdb0f34

  • SHA256

    5bc0378b3140c0f46dfaead21a68142928b7f5af6b2b0e142639fb3d28b1008b

  • SHA512

    5c8a0f71418c20093c39e2c222a4fec993739f32702dbf05758eaabb9f984be65d607d5eb0216c43652b957bfb6dc274b3d748a3f4d1d023a6ec25f50f20d1c9

Score
1/10

Malware Config

Signatures

  • Suspicious use of WriteProcessMemory 2 IoCs
  • Views/modifies file attributes 1 TTPs 1 IoCs
    evasion

Processes

  • C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\Win32.Pegasus\Pegasus\tools\rebuild_project.bat"
    1⤵
    • Suspicious use of WriteProcessMemory
    PID:2228
    • C:\Windows\system32\attrib.exe
      attrib -R "..\binres\."
      2⤵
      • Views/modifies file attributes
      PID:2604

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Hidden Files and Directories

1
T1158

Privilege Escalation

Defense Evasion

Hidden Files and Directories

1
T1158

Credential Access

Discovery

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

  • memory/2604-114-0x0000000000000000-mapping.dmp
    Download