Analysis
-
max time kernel
122s -
max time network
126s -
platform
windows7_x64 -
resource
win7-20231215-en -
resource tags
arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system -
submitted
24/12/2023, 17:18
Static task
static1
Behavioral task
behavioral1
Sample
0804076bdf69c5cbad5b767a2d7b2e4d.exe
Resource
win7-20231215-en
3 signatures
150 seconds
Behavioral task
behavioral2
Sample
0804076bdf69c5cbad5b767a2d7b2e4d.exe
Resource
win10v2004-20231215-en
2 signatures
150 seconds
General
-
Target
0804076bdf69c5cbad5b767a2d7b2e4d.exe
-
Size
462KB
-
MD5
0804076bdf69c5cbad5b767a2d7b2e4d
-
SHA1
864e22bf411be4e6daac6217e21d5de898ab672e
-
SHA256
11ee886cdd012d58e5d4f3fb2a4af4a7e002a20f68303359a2024c7c3d947242
-
SHA512
6764b6893771a5971fe0da0456bc288080dcee812b085b514f8b0598f4f96fa9647f9692ff3b3cbe8728ccd49951251bdc6b1a7e94ee6dcd5353fb9237454a65
-
SSDEEP
12288:C9nH2oQO7BbrB39JUodXMlmas1JQNiUZuSXj:CgoLB3B/pMkasnQNiUMSXj
Score
7/10
Malware Config
Signatures
-
Deletes itself 1 IoCs
pid Process 2572 cmd.exe -
Runs ping.exe 1 TTPs 1 IoCs
pid Process 2620 PING.EXE -
Suspicious use of WriteProcessMemory 8 IoCs
description pid Process procid_target PID 1968 wrote to memory of 2572 1968 0804076bdf69c5cbad5b767a2d7b2e4d.exe 31 PID 1968 wrote to memory of 2572 1968 0804076bdf69c5cbad5b767a2d7b2e4d.exe 31 PID 1968 wrote to memory of 2572 1968 0804076bdf69c5cbad5b767a2d7b2e4d.exe 31 PID 1968 wrote to memory of 2572 1968 0804076bdf69c5cbad5b767a2d7b2e4d.exe 31 PID 2572 wrote to memory of 2620 2572 cmd.exe 33 PID 2572 wrote to memory of 2620 2572 cmd.exe 33 PID 2572 wrote to memory of 2620 2572 cmd.exe 33 PID 2572 wrote to memory of 2620 2572 cmd.exe 33
Processes
-
C:\Users\Admin\AppData\Local\Temp\0804076bdf69c5cbad5b767a2d7b2e4d.exe"C:\Users\Admin\AppData\Local\Temp\0804076bdf69c5cbad5b767a2d7b2e4d.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:1968 -
C:\Windows\SysWOW64\cmd.execmd.exe /C ping 1.1.1.1 -n 1 -w 3000 > Nul & Del "C:\Users\Admin\AppData\Local\Temp\0804076bdf69c5cbad5b767a2d7b2e4d.exe"2⤵
- Deletes itself
- Suspicious use of WriteProcessMemory
PID:2572 -
C:\Windows\SysWOW64\PING.EXEping 1.1.1.1 -n 1 -w 30003⤵
- Runs ping.exe
PID:2620
-
-