7acb5eabb9d002e32923191a8497d5df39ceb0bb8c26b4224666eebaf4d336b4

Analysis

max time kernel
120s
max time network
123s
platform
windows7_x64
resource
win7-20230831-en
resource tags

arch:x64arch:x86image:win7-20230831-enlocale:en-usos:windows7-x64system
submitted
04/10/2023, 11:55

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

7acb5eabb9d002e32923191a8497d5df39ceb0bb8c26b4224666eebaf4d336b4.exe
Size

508KB
MD5

ebf41dca08eaff6619674ad8bb1a64fc
SHA1

6d8b15a7c8d773592bd8cf3d01fb62496685fa47
SHA256

7acb5eabb9d002e32923191a8497d5df39ceb0bb8c26b4224666eebaf4d336b4
SHA512

bf6c69001088009525e8507218b7802adaecbd95baa4aac8c6bcb453ad2f5f5ef7d7e9fb457d82f19e4026d74cc9444b939d17692ea52832406dd7e12a4a9a9a
SSDEEP

6144:tW0J07EHxsWKKCbrZXDbI33z5P/kjguInr39tAOLPvI1ILz:44CWKKCrZTGF/k8uMxtxPvvz

Score

7^/10

Malware Config

Signatures

Deletes itself 1 IoCs

pid	Process
2804	cmd.exe

Drops file in Windows directory 1 IoCs

description	ioc	Process
File opened for modification	C:\Windows\tkjsidfsd	7acb5eabb9d002e32923191a8497d5df39ceb0bb8c26b4224666eebaf4d336b4.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious behavior: EnumeratesProcesses 60 IoCs

pid	Process
2980	7acb5eabb9d002e32923191a8497d5df39ceb0bb8c26b4224666eebaf4d336b4.exe
2980	7acb5eabb9d002e32923191a8497d5df39ceb0bb8c26b4224666eebaf4d336b4.exe
2980	7acb5eabb9d002e32923191a8497d5df39ceb0bb8c26b4224666eebaf4d336b4.exe
2980	7acb5eabb9d002e32923191a8497d5df39ceb0bb8c26b4224666eebaf4d336b4.exe
2980	7acb5eabb9d002e32923191a8497d5df39ceb0bb8c26b4224666eebaf4d336b4.exe
2980	7acb5eabb9d002e32923191a8497d5df39ceb0bb8c26b4224666eebaf4d336b4.exe
2980	7acb5eabb9d002e32923191a8497d5df39ceb0bb8c26b4224666eebaf4d336b4.exe
2980	7acb5eabb9d002e32923191a8497d5df39ceb0bb8c26b4224666eebaf4d336b4.exe
2980	7acb5eabb9d002e32923191a8497d5df39ceb0bb8c26b4224666eebaf4d336b4.exe
2980	7acb5eabb9d002e32923191a8497d5df39ceb0bb8c26b4224666eebaf4d336b4.exe
2980	7acb5eabb9d002e32923191a8497d5df39ceb0bb8c26b4224666eebaf4d336b4.exe
2980	7acb5eabb9d002e32923191a8497d5df39ceb0bb8c26b4224666eebaf4d336b4.exe
2980	7acb5eabb9d002e32923191a8497d5df39ceb0bb8c26b4224666eebaf4d336b4.exe
2980	7acb5eabb9d002e32923191a8497d5df39ceb0bb8c26b4224666eebaf4d336b4.exe
2980	7acb5eabb9d002e32923191a8497d5df39ceb0bb8c26b4224666eebaf4d336b4.exe
2980	7acb5eabb9d002e32923191a8497d5df39ceb0bb8c26b4224666eebaf4d336b4.exe
2980	7acb5eabb9d002e32923191a8497d5df39ceb0bb8c26b4224666eebaf4d336b4.exe
2980	7acb5eabb9d002e32923191a8497d5df39ceb0bb8c26b4224666eebaf4d336b4.exe
2980	7acb5eabb9d002e32923191a8497d5df39ceb0bb8c26b4224666eebaf4d336b4.exe
2980	7acb5eabb9d002e32923191a8497d5df39ceb0bb8c26b4224666eebaf4d336b4.exe
2980	7acb5eabb9d002e32923191a8497d5df39ceb0bb8c26b4224666eebaf4d336b4.exe
2980	7acb5eabb9d002e32923191a8497d5df39ceb0bb8c26b4224666eebaf4d336b4.exe
2980	7acb5eabb9d002e32923191a8497d5df39ceb0bb8c26b4224666eebaf4d336b4.exe
2980	7acb5eabb9d002e32923191a8497d5df39ceb0bb8c26b4224666eebaf4d336b4.exe
2980	7acb5eabb9d002e32923191a8497d5df39ceb0bb8c26b4224666eebaf4d336b4.exe
2980	7acb5eabb9d002e32923191a8497d5df39ceb0bb8c26b4224666eebaf4d336b4.exe
2980	7acb5eabb9d002e32923191a8497d5df39ceb0bb8c26b4224666eebaf4d336b4.exe
2980	7acb5eabb9d002e32923191a8497d5df39ceb0bb8c26b4224666eebaf4d336b4.exe
2980	7acb5eabb9d002e32923191a8497d5df39ceb0bb8c26b4224666eebaf4d336b4.exe
2980	7acb5eabb9d002e32923191a8497d5df39ceb0bb8c26b4224666eebaf4d336b4.exe
2980	7acb5eabb9d002e32923191a8497d5df39ceb0bb8c26b4224666eebaf4d336b4.exe
2980	7acb5eabb9d002e32923191a8497d5df39ceb0bb8c26b4224666eebaf4d336b4.exe
2980	7acb5eabb9d002e32923191a8497d5df39ceb0bb8c26b4224666eebaf4d336b4.exe
2980	7acb5eabb9d002e32923191a8497d5df39ceb0bb8c26b4224666eebaf4d336b4.exe
2980	7acb5eabb9d002e32923191a8497d5df39ceb0bb8c26b4224666eebaf4d336b4.exe
2980	7acb5eabb9d002e32923191a8497d5df39ceb0bb8c26b4224666eebaf4d336b4.exe
2980	7acb5eabb9d002e32923191a8497d5df39ceb0bb8c26b4224666eebaf4d336b4.exe
2980	7acb5eabb9d002e32923191a8497d5df39ceb0bb8c26b4224666eebaf4d336b4.exe
2980	7acb5eabb9d002e32923191a8497d5df39ceb0bb8c26b4224666eebaf4d336b4.exe
2980	7acb5eabb9d002e32923191a8497d5df39ceb0bb8c26b4224666eebaf4d336b4.exe
2980	7acb5eabb9d002e32923191a8497d5df39ceb0bb8c26b4224666eebaf4d336b4.exe
2980	7acb5eabb9d002e32923191a8497d5df39ceb0bb8c26b4224666eebaf4d336b4.exe
2980	7acb5eabb9d002e32923191a8497d5df39ceb0bb8c26b4224666eebaf4d336b4.exe
2980	7acb5eabb9d002e32923191a8497d5df39ceb0bb8c26b4224666eebaf4d336b4.exe
2980	7acb5eabb9d002e32923191a8497d5df39ceb0bb8c26b4224666eebaf4d336b4.exe
2980	7acb5eabb9d002e32923191a8497d5df39ceb0bb8c26b4224666eebaf4d336b4.exe
2980	7acb5eabb9d002e32923191a8497d5df39ceb0bb8c26b4224666eebaf4d336b4.exe
2980	7acb5eabb9d002e32923191a8497d5df39ceb0bb8c26b4224666eebaf4d336b4.exe
2980	7acb5eabb9d002e32923191a8497d5df39ceb0bb8c26b4224666eebaf4d336b4.exe
2980	7acb5eabb9d002e32923191a8497d5df39ceb0bb8c26b4224666eebaf4d336b4.exe
2980	7acb5eabb9d002e32923191a8497d5df39ceb0bb8c26b4224666eebaf4d336b4.exe
2980	7acb5eabb9d002e32923191a8497d5df39ceb0bb8c26b4224666eebaf4d336b4.exe
2980	7acb5eabb9d002e32923191a8497d5df39ceb0bb8c26b4224666eebaf4d336b4.exe
2980	7acb5eabb9d002e32923191a8497d5df39ceb0bb8c26b4224666eebaf4d336b4.exe
2980	7acb5eabb9d002e32923191a8497d5df39ceb0bb8c26b4224666eebaf4d336b4.exe
2980	7acb5eabb9d002e32923191a8497d5df39ceb0bb8c26b4224666eebaf4d336b4.exe
2980	7acb5eabb9d002e32923191a8497d5df39ceb0bb8c26b4224666eebaf4d336b4.exe
2980	7acb5eabb9d002e32923191a8497d5df39ceb0bb8c26b4224666eebaf4d336b4.exe
2980	7acb5eabb9d002e32923191a8497d5df39ceb0bb8c26b4224666eebaf4d336b4.exe
2980	7acb5eabb9d002e32923191a8497d5df39ceb0bb8c26b4224666eebaf4d336b4.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2980 wrote to memory of 2804	2980	7acb5eabb9d002e32923191a8497d5df39ceb0bb8c26b4224666eebaf4d336b4.exe	30
PID 2980 wrote to memory of 2804	2980	7acb5eabb9d002e32923191a8497d5df39ceb0bb8c26b4224666eebaf4d336b4.exe	30
PID 2980 wrote to memory of 2804	2980	7acb5eabb9d002e32923191a8497d5df39ceb0bb8c26b4224666eebaf4d336b4.exe	30
PID 2980 wrote to memory of 2804	2980	7acb5eabb9d002e32923191a8497d5df39ceb0bb8c26b4224666eebaf4d336b4.exe	30

C:\Users\Admin\AppData\Local\Temp\7acb5eabb9d002e32923191a8497d5df39ceb0bb8c26b4224666eebaf4d336b4.exe
"C:\Users\Admin\AppData\Local\Temp\7acb5eabb9d002e32923191a8497d5df39ceb0bb8c26b4224666eebaf4d336b4.exe"
1⤵
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:2980
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /c del "C:\Users\Admin\AppData\Local\Temp\7acb5eabb9d002e32923191a8497d5df39ceb0bb8c26b4224666eebaf4d336b4.exe"
  2⤵
  - Deletes itself
  PID:2804

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\tkjsidfsd

Filesize
89B

MD5
567d19324da03379673fe611c5f35622

SHA1
ee96f5bbcafa7ad0f79a1ad935ffe07ba686252b

SHA256
68a8622859f780d0811e2657e8e37d0a2227fe3cfd25d731a27e983c594f742f

SHA512
f3426a97c49454786e3bb3b53c806218f1d798df8389ba6c8ff89996afbbf28abfa2d3f11d7b9d7a41cc0a1498b262bcacffd3715f66d760a0b15f67ef21b1a1

Download Submit
C:\Windows\tkjsidfsd

Filesize
48B

MD5
2e0b547daff9fa673438d0261f8e25fd

SHA1
fef641f21ba3b947e0a969c92c38584167135704

SHA256
959c824d2233bdfd7811c5078f6886ac658b25cccf1cd816fe55c5cc76437b8b

SHA512
7cd29f864ce6fc077c4f1e4419210dfd4d801682fc37c1385aed10759877c1f90dcd8c15608deabf906ebd36ef9c40c0c5713c51e2757627b12708d95d69e83e

Download Submit
C:\Windows\tkjsidfsd

Filesize
121B

MD5
3012d559a294222d8905984fd64679b7

SHA1
9824611780a7dcd7e010b46d823c29278f3fc63d

SHA256
6d162651c26c56d88ed41d7aebf1e72baeb2fd9d550f3e0556428c5a395546a8

SHA512
631e91076b864295fae7c6bf3bb1c8ba6969c112f5b77f0826516e46e7dad68658fe8b7e95dbe3f0bdac0d9dadd0067fc9f735500e236d21181f047256dbd15e

Download Submit