5d26ad82cab996504ecf6053be95c8df1363d02a2552b688f531e20814356969

Analysis

max time kernel
7s
max time network
44s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
24/12/2023, 20:18

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

1063da0d257d406e7e74bde623872363.exe
Size

93KB
MD5

1063da0d257d406e7e74bde623872363
SHA1

db6ab7043b0655d54118f135b4e996b1dd61b7aa
SHA256

5d26ad82cab996504ecf6053be95c8df1363d02a2552b688f531e20814356969
SHA512

7660032801c4be7260d0bff14f69da494e7e888a3e49dd511758f8756c945b0afbcd289a63cf7fc4092c66c7e27a048213e2df7f2871258ae7aef5500b91db3b
SSDEEP

1536:NyQT05QG70AQz6CwvonnZfr0od8yQoAX2D357dGweFrBNo8DirUrlFIy:HZD0o3A2lZirztrlFIy

Score

7^/10

Malware Config

Signatures

Deletes itself 1 IoCs

pid	Process
2720	cmd.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1352 wrote to memory of 2720	1352	1063da0d257d406e7e74bde623872363.exe	30
PID 1352 wrote to memory of 2720	1352	1063da0d257d406e7e74bde623872363.exe	30
PID 1352 wrote to memory of 2720	1352	1063da0d257d406e7e74bde623872363.exe	30
PID 1352 wrote to memory of 2720	1352	1063da0d257d406e7e74bde623872363.exe	30

C:\Users\Admin\AppData\Local\Temp\1063da0d257d406e7e74bde623872363.exe
"C:\Users\Admin\AppData\Local\Temp\1063da0d257d406e7e74bde623872363.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1352
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\system32\cmd.exe" /q /c "C:\Users\Admin\AppData\Local\Temp\Dvf..bat" > nul 2> nul
  2⤵
  - Deletes itself
  PID:2720

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\Dvf..bat

Filesize
210B

MD5
a91f3b796f747dfb0e67c05640c39250

SHA1
08093e54023e78cbb7d790c10ae45a8fb02ef964

SHA256
0fd5e903098274c7313e925853d301169cbaca8253e5ca8af08f9b17224e996e

SHA512
04dcce6caf4d15240a25a015d00f6423d0440db2936b5addc5e9dfe0fb80fc73b53ed5b5e9292061d3513d55ea243de645a75eac55379321ac03de3397e30139

Download Submit
memory/1352-0-0x0000000000400000-0x000000000041C000-memory.dmp

Filesize
112KB

Download
memory/1352-1-0x00000000002B0000-0x00000000002B1000-memory.dmp

Filesize
4KB

Download
memory/1352-2-0x0000000000400000-0x000000000041C000-memory.dmp

Filesize
112KB

Download
memory/1352-3-0x0000000000400000-0x000000000041C000-memory.dmp

Filesize
112KB

Download
memory/1352-5-0x0000000000400000-0x000000000041C000-memory.dmp

Filesize
112KB

Download