06120b3bd5690fced06d2db5287001cf6044b97380d08548c60085206f131054

Analysis

max time kernel
119s
max time network
123s
platform
windows7_x64
resource
win7-20230712-en
resource tags

arch:x64arch:x86image:win7-20230712-enlocale:en-usos:windows7-x64system
submitted
29/08/2023, 18:03

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

06120b3bd5690fced06d2db5287001cf6044b97380d08548c60085206f131054.exe
Size

508KB
MD5

5541f014b5c1dc06d22551e57d20138d
SHA1

b6f8ebf036b5db686bb09cbd827cdcfb12347242
SHA256

06120b3bd5690fced06d2db5287001cf6044b97380d08548c60085206f131054
SHA512

20b24fe4fc2a0fa0b9a27d51dcf878944d1615bdb21691626dd60bbf7c0338936440f48cd7bf65eb66f8d0ee2e8145f22574a6a05bda0bd03b7bb4c71b0bb592
SSDEEP

6144:yW0J07EHxsWKKCbrZXDbI33z5P/kjguInr39tAOLPvI1ILz:54CWKKCrZTGF/k8uMxtxPvvz

Score

7^/10

Malware Config

Signatures

Deletes itself 1 IoCs

pid	Process
336	cmd.exe

Drops file in Windows directory 1 IoCs

description	ioc	Process
File opened for modification	C:\Windows\tkjsidfsd	06120b3bd5690fced06d2db5287001cf6044b97380d08548c60085206f131054.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious behavior: EnumeratesProcesses 60 IoCs

pid	Process
2592	06120b3bd5690fced06d2db5287001cf6044b97380d08548c60085206f131054.exe
2592	06120b3bd5690fced06d2db5287001cf6044b97380d08548c60085206f131054.exe
2592	06120b3bd5690fced06d2db5287001cf6044b97380d08548c60085206f131054.exe
2592	06120b3bd5690fced06d2db5287001cf6044b97380d08548c60085206f131054.exe
2592	06120b3bd5690fced06d2db5287001cf6044b97380d08548c60085206f131054.exe
2592	06120b3bd5690fced06d2db5287001cf6044b97380d08548c60085206f131054.exe
2592	06120b3bd5690fced06d2db5287001cf6044b97380d08548c60085206f131054.exe
2592	06120b3bd5690fced06d2db5287001cf6044b97380d08548c60085206f131054.exe
2592	06120b3bd5690fced06d2db5287001cf6044b97380d08548c60085206f131054.exe
2592	06120b3bd5690fced06d2db5287001cf6044b97380d08548c60085206f131054.exe
2592	06120b3bd5690fced06d2db5287001cf6044b97380d08548c60085206f131054.exe
2592	06120b3bd5690fced06d2db5287001cf6044b97380d08548c60085206f131054.exe
2592	06120b3bd5690fced06d2db5287001cf6044b97380d08548c60085206f131054.exe
2592	06120b3bd5690fced06d2db5287001cf6044b97380d08548c60085206f131054.exe
2592	06120b3bd5690fced06d2db5287001cf6044b97380d08548c60085206f131054.exe
2592	06120b3bd5690fced06d2db5287001cf6044b97380d08548c60085206f131054.exe
2592	06120b3bd5690fced06d2db5287001cf6044b97380d08548c60085206f131054.exe
2592	06120b3bd5690fced06d2db5287001cf6044b97380d08548c60085206f131054.exe
2592	06120b3bd5690fced06d2db5287001cf6044b97380d08548c60085206f131054.exe
2592	06120b3bd5690fced06d2db5287001cf6044b97380d08548c60085206f131054.exe
2592	06120b3bd5690fced06d2db5287001cf6044b97380d08548c60085206f131054.exe
2592	06120b3bd5690fced06d2db5287001cf6044b97380d08548c60085206f131054.exe
2592	06120b3bd5690fced06d2db5287001cf6044b97380d08548c60085206f131054.exe
2592	06120b3bd5690fced06d2db5287001cf6044b97380d08548c60085206f131054.exe
2592	06120b3bd5690fced06d2db5287001cf6044b97380d08548c60085206f131054.exe
2592	06120b3bd5690fced06d2db5287001cf6044b97380d08548c60085206f131054.exe
2592	06120b3bd5690fced06d2db5287001cf6044b97380d08548c60085206f131054.exe
2592	06120b3bd5690fced06d2db5287001cf6044b97380d08548c60085206f131054.exe
2592	06120b3bd5690fced06d2db5287001cf6044b97380d08548c60085206f131054.exe
2592	06120b3bd5690fced06d2db5287001cf6044b97380d08548c60085206f131054.exe
2592	06120b3bd5690fced06d2db5287001cf6044b97380d08548c60085206f131054.exe
2592	06120b3bd5690fced06d2db5287001cf6044b97380d08548c60085206f131054.exe
2592	06120b3bd5690fced06d2db5287001cf6044b97380d08548c60085206f131054.exe
2592	06120b3bd5690fced06d2db5287001cf6044b97380d08548c60085206f131054.exe
2592	06120b3bd5690fced06d2db5287001cf6044b97380d08548c60085206f131054.exe
2592	06120b3bd5690fced06d2db5287001cf6044b97380d08548c60085206f131054.exe
2592	06120b3bd5690fced06d2db5287001cf6044b97380d08548c60085206f131054.exe
2592	06120b3bd5690fced06d2db5287001cf6044b97380d08548c60085206f131054.exe
2592	06120b3bd5690fced06d2db5287001cf6044b97380d08548c60085206f131054.exe
2592	06120b3bd5690fced06d2db5287001cf6044b97380d08548c60085206f131054.exe
2592	06120b3bd5690fced06d2db5287001cf6044b97380d08548c60085206f131054.exe
2592	06120b3bd5690fced06d2db5287001cf6044b97380d08548c60085206f131054.exe
2592	06120b3bd5690fced06d2db5287001cf6044b97380d08548c60085206f131054.exe
2592	06120b3bd5690fced06d2db5287001cf6044b97380d08548c60085206f131054.exe
2592	06120b3bd5690fced06d2db5287001cf6044b97380d08548c60085206f131054.exe
2592	06120b3bd5690fced06d2db5287001cf6044b97380d08548c60085206f131054.exe
2592	06120b3bd5690fced06d2db5287001cf6044b97380d08548c60085206f131054.exe
2592	06120b3bd5690fced06d2db5287001cf6044b97380d08548c60085206f131054.exe
2592	06120b3bd5690fced06d2db5287001cf6044b97380d08548c60085206f131054.exe
2592	06120b3bd5690fced06d2db5287001cf6044b97380d08548c60085206f131054.exe
2592	06120b3bd5690fced06d2db5287001cf6044b97380d08548c60085206f131054.exe
2592	06120b3bd5690fced06d2db5287001cf6044b97380d08548c60085206f131054.exe
2592	06120b3bd5690fced06d2db5287001cf6044b97380d08548c60085206f131054.exe
2592	06120b3bd5690fced06d2db5287001cf6044b97380d08548c60085206f131054.exe
2592	06120b3bd5690fced06d2db5287001cf6044b97380d08548c60085206f131054.exe
2592	06120b3bd5690fced06d2db5287001cf6044b97380d08548c60085206f131054.exe
2592	06120b3bd5690fced06d2db5287001cf6044b97380d08548c60085206f131054.exe
2592	06120b3bd5690fced06d2db5287001cf6044b97380d08548c60085206f131054.exe
2592	06120b3bd5690fced06d2db5287001cf6044b97380d08548c60085206f131054.exe
2592	06120b3bd5690fced06d2db5287001cf6044b97380d08548c60085206f131054.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2592 wrote to memory of 336	2592	06120b3bd5690fced06d2db5287001cf6044b97380d08548c60085206f131054.exe	30
PID 2592 wrote to memory of 336	2592	06120b3bd5690fced06d2db5287001cf6044b97380d08548c60085206f131054.exe	30
PID 2592 wrote to memory of 336	2592	06120b3bd5690fced06d2db5287001cf6044b97380d08548c60085206f131054.exe	30
PID 2592 wrote to memory of 336	2592	06120b3bd5690fced06d2db5287001cf6044b97380d08548c60085206f131054.exe	30

C:\Users\Admin\AppData\Local\Temp\06120b3bd5690fced06d2db5287001cf6044b97380d08548c60085206f131054.exe
"C:\Users\Admin\AppData\Local\Temp\06120b3bd5690fced06d2db5287001cf6044b97380d08548c60085206f131054.exe"
1⤵
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:2592
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /c del "C:\Users\Admin\AppData\Local\Temp\06120b3bd5690fced06d2db5287001cf6044b97380d08548c60085206f131054.exe"
  2⤵
  - Deletes itself
  PID:336

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\tkjsidfsd

Filesize
93B

MD5
df46ab9e4ae4b262c6998ba7343c2741

SHA1
1575b9b229e6d426315b518d88937c146e78df87

SHA256
c8db66506ad108f371731f9b3ae0b92c279896240ea11fe34f1eafa97d27372a

SHA512
35fc5293b020f5bf354c2b0727273f98570be1fef144c931f2287f9ceab4c360ba3782924dfb6990937bdff741b89750415c0ce6c4895bb6f0977e40a1a43953

Download Submit
C:\Windows\tkjsidfsd

Filesize
46B

MD5
8a4ea0bf3abf7d6358015e51e64bdc46

SHA1
d0120704a90cc9360939c1711a27bf92cfc3b282

SHA256
5078243425d0cf244bf2f756f88074f35e05b8db7e21766abc259b478e4364b5

SHA512
75cf2fbaa2139c1455461fb98a1779588b51ccc084399323b5b40c77dffc7f97a65a3146ac818f52c59602d8723eab5ebd9e0017cc5e8d3751e2866e45ad95b9

Download Submit