818b0aae577ca6f53839623e0217e94d6e9c887ed42e3a836c8c713659768df6

Analysis

max time kernel
161s
max time network
144s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
25/12/2023, 06:48

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

0cb4b1c78fe08be57c0b9269d8119558.exe
Size

84KB
MD5

0cb4b1c78fe08be57c0b9269d8119558
SHA1

1869e23988d5cff7b555fa6cbec709bd9931ad33
SHA256

818b0aae577ca6f53839623e0217e94d6e9c887ed42e3a836c8c713659768df6
SHA512

3b7cf8b42304d6bdac24f9313f2ca8e9817eb6149cc822a2f554b1a5a3842f18792f04679a8a4a3f25643c4a4dc4d7946b69cb6f7822dbf0b340769b3a2aa199
SSDEEP

1536:EoxQqso2KQkSof2XlhTlt50NQl7VR3TT1QtEx/5mq5OCbkX3T1W5hfljB:5xQq32/kSnhTWmR3KtExBRO0kXktB

Score

8^/10

evasion

Malware Config

Signatures

Sets file to hidden 1 TTPs 1 IoCs

Modifies file attributes to stop it showing in Explorer etc.

evasion

Hidden Files and Directories

T1564.001

pid	Process
2584	attrib.exe

Deletes itself 1 IoCs

pid	Process
2816	cmd.exe

Executes dropped EXE 1 IoCs

pid	Process
2608	IEXPL0RE.exe

Loads dropped DLL 2 IoCs

pid	Process
2816	cmd.exe
2816	cmd.exe

Drops file in Windows directory 4 IoCs

description	ioc	Process
File created	C:\Windows\Web\705.5475.bat	0cb4b1c78fe08be57c0b9269d8119558.exe
File created	C:\Windows\Web\IEXPL0RE.exe	cmd.exe
File opened for modification	C:\Windows\Web\IEXPL0RE.exe	cmd.exe
File opened for modification	C:\Windows\Web\IEXPL0RE.exe	attrib.exe

Kills process with taskkill 3 IoCs

evasion

pid	Process
2000	taskkill.exe
1940	taskkill.exe
2496	taskkill.exe

Runs ping.exe 1 TTPs 1 IoCs

Remote System Discovery

T1018

pid	Process
2704	PING.EXE

Suspicious use of AdjustPrivilegeToken 3 IoCs

description	pid	Process
Token: SeDebugPrivilege	1940	taskkill.exe
Token: SeDebugPrivilege	2496	taskkill.exe
Token: SeDebugPrivilege	2000	taskkill.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
2684	0cb4b1c78fe08be57c0b9269d8119558.exe
2608	IEXPL0RE.exe

Suspicious use of WriteProcessMemory 40 IoCs

description	pid	Process	procid_target
PID 2684 wrote to memory of 2816	2684	0cb4b1c78fe08be57c0b9269d8119558.exe	28
PID 2684 wrote to memory of 2816	2684	0cb4b1c78fe08be57c0b9269d8119558.exe	28
PID 2684 wrote to memory of 2816	2684	0cb4b1c78fe08be57c0b9269d8119558.exe	28
PID 2684 wrote to memory of 2816	2684	0cb4b1c78fe08be57c0b9269d8119558.exe	28
PID 2816 wrote to memory of 2704	2816	cmd.exe	30
PID 2816 wrote to memory of 2704	2816	cmd.exe	30
PID 2816 wrote to memory of 2704	2816	cmd.exe	30
PID 2816 wrote to memory of 2704	2816	cmd.exe	30
PID 2816 wrote to memory of 2584	2816	cmd.exe	33
PID 2816 wrote to memory of 2584	2816	cmd.exe	33
PID 2816 wrote to memory of 2584	2816	cmd.exe	33
PID 2816 wrote to memory of 2584	2816	cmd.exe	33
PID 2816 wrote to memory of 2608	2816	cmd.exe	34
PID 2816 wrote to memory of 2608	2816	cmd.exe	34
PID 2816 wrote to memory of 2608	2816	cmd.exe	34
PID 2816 wrote to memory of 2608	2816	cmd.exe	34
PID 2608 wrote to memory of 2412	2608	IEXPL0RE.exe	35
PID 2608 wrote to memory of 2412	2608	IEXPL0RE.exe	35
PID 2608 wrote to memory of 2412	2608	IEXPL0RE.exe	35
PID 2608 wrote to memory of 2412	2608	IEXPL0RE.exe	35
PID 2608 wrote to memory of 2156	2608	IEXPL0RE.exe	36
PID 2608 wrote to memory of 2156	2608	IEXPL0RE.exe	36
PID 2608 wrote to memory of 2156	2608	IEXPL0RE.exe	36
PID 2608 wrote to memory of 2156	2608	IEXPL0RE.exe	36
PID 2608 wrote to memory of 3028	2608	IEXPL0RE.exe	37
PID 2608 wrote to memory of 3028	2608	IEXPL0RE.exe	37
PID 2608 wrote to memory of 3028	2608	IEXPL0RE.exe	37
PID 2608 wrote to memory of 3028	2608	IEXPL0RE.exe	37
PID 2412 wrote to memory of 2000	2412	cmd.exe	42
PID 2412 wrote to memory of 2000	2412	cmd.exe	42
PID 2412 wrote to memory of 2000	2412	cmd.exe	42
PID 2412 wrote to memory of 2000	2412	cmd.exe	42
PID 3028 wrote to memory of 1940	3028	cmd.exe	43
PID 3028 wrote to memory of 1940	3028	cmd.exe	43
PID 3028 wrote to memory of 1940	3028	cmd.exe	43
PID 3028 wrote to memory of 1940	3028	cmd.exe	43
PID 2156 wrote to memory of 2496	2156	cmd.exe	41
PID 2156 wrote to memory of 2496	2156	cmd.exe	41
PID 2156 wrote to memory of 2496	2156	cmd.exe	41
PID 2156 wrote to memory of 2496	2156	cmd.exe	41

Views/modifies file attributes 1 TTPs 1 IoCs

evasion

Hidden Files and Directories

T1564.001

pid	Process
2584	attrib.exe

C:\Users\Admin\AppData\Local\Temp\0cb4b1c78fe08be57c0b9269d8119558.exe
"C:\Users\Admin\AppData\Local\Temp\0cb4b1c78fe08be57c0b9269d8119558.exe"
1⤵
- Drops file in Windows directory
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2684
- C:\Windows\SysWOW64\cmd.exe
  cmd /c C:\Windows\Web\705.5475.bat
  2⤵
  - Deletes itself
  - Loads dropped DLL
  - Drops file in Windows directory
  - Suspicious use of WriteProcessMemory
  PID:2816
- - C:\Windows\SysWOW64\PING.EXE
    ping 127.0.0.1
    3⤵
    - Runs ping.exe
    PID:2704
- - C:\Windows\SysWOW64\attrib.exe
    attrib +s +h "C:\Windows\Web\IEXPL0RE.exe"
    3⤵
    - Sets file to hidden
    - Drops file in Windows directory
    - Views/modifies file attributes
    PID:2584
- - C:\Windows\Web\IEXPL0RE.exe
    "C:\Windows\Web\IEXPL0RE.exe"
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:2608
  - - C:\Windows\SysWOW64\cmd.exe
      cmd /c taskkill /f /im qq.exe
      4⤵
      Suspicious use of WriteProcessMemory
      PID:2412
    - - C:\Windows\SysWOW64\taskkill.exe
        
        taskkill /f /im qq.exe
        5⤵
        Kills process with taskkill
        Suspicious use of AdjustPrivilegeToken
        
        PID:2000
  - - C:\Windows\SysWOW64\cmd.exe
      cmd /c taskkill /f /im Rstray.exe
      4⤵
      Suspicious use of WriteProcessMemory
      PID:2156
    - - C:\Windows\SysWOW64\taskkill.exe
        
        taskkill /f /im Rstray.exe
        5⤵
        Kills process with taskkill
        Suspicious use of AdjustPrivilegeToken
        
        PID:2496
  - - C:\Windows\SysWOW64\cmd.exe
      cmd /c taskkill /f /im 360tray.exe
      4⤵
      Suspicious use of WriteProcessMemory
      PID:3028
    - - C:\Windows\SysWOW64\taskkill.exe
        
        taskkill /f /im 360tray.exe
        5⤵
        Kills process with taskkill
        Suspicious use of AdjustPrivilegeToken
        
        PID:1940

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Hide Artifacts

T1564

Hidden Files and Directories

T1564.001

Credential Access

Discovery

Remote System Discovery

T1018

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\Web\705.5475.bat

Filesize
297B

MD5
04bf8acdee8e72ca85ecd6ba3d69aa4d

SHA1
0371925d8803ed119792e9f918e6462abbde01c8

SHA256
ac4baf6934c4b379e94785067b6b4024aa36cd5d9372cf6b1d4a2cb65631b912

SHA512
d4132a65d6eeef29a47e58ff725e7dea40fee05645cfe38ad0a1925da34af5198ff797dd7d2b02b340db4cd242b84429f41786cb16af46b07aaa71fc7ea7d72a

Download Submit
C:\Windows\Web\IEXPL0RE.exe

Filesize
84KB

MD5
0cb4b1c78fe08be57c0b9269d8119558

SHA1
1869e23988d5cff7b555fa6cbec709bd9931ad33

SHA256
818b0aae577ca6f53839623e0217e94d6e9c887ed42e3a836c8c713659768df6

SHA512
3b7cf8b42304d6bdac24f9313f2ca8e9817eb6149cc822a2f554b1a5a3842f18792f04679a8a4a3f25643c4a4dc4d7946b69cb6f7822dbf0b340769b3a2aa199

Download Submit
memory/2608-19-0x0000000000400000-0x0000000000459000-memory.dmp

Filesize
356KB

Download
memory/2684-9-0x0000000000400000-0x0000000000459000-memory.dmp

Filesize
356KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads