4e1f8cad8ae42b027b1d90796f4c7714e55a1971044610cf83aff291752630d3

Analysis

max time kernel
121s
max time network
126s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
25/12/2023, 13:47

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

22eba1945ea7ccc18cb002b940b7fb69.exe
Size

94KB
MD5

22eba1945ea7ccc18cb002b940b7fb69
SHA1

b1ebaef81579df14576efdf568ee30b6159abbff
SHA256

4e1f8cad8ae42b027b1d90796f4c7714e55a1971044610cf83aff291752630d3
SHA512

16a116665c9b230b42af42394a88db249cb63388d7eaa95896c67457a3af09982f9e6a1da230a0a8240494c883254665348d14a93913f0739083428174eeef2d
SSDEEP

1536:nfg+M2Y9oH+cpTKeyaI0Z/od8bDbRvU5yYeVYXrgITAGXBB3exYEjpepikFIy:nfgyY9oH+cTKGI0Z/oooeVYXrgI0GXW4

Score

7^/10

Malware Config

Signatures

Deletes itself 1 IoCs

pid	Process
2764	cmd.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2964 wrote to memory of 2764	2964	22eba1945ea7ccc18cb002b940b7fb69.exe	28
PID 2964 wrote to memory of 2764	2964	22eba1945ea7ccc18cb002b940b7fb69.exe	28
PID 2964 wrote to memory of 2764	2964	22eba1945ea7ccc18cb002b940b7fb69.exe	28
PID 2964 wrote to memory of 2764	2964	22eba1945ea7ccc18cb002b940b7fb69.exe	28

C:\Users\Admin\AppData\Local\Temp\22eba1945ea7ccc18cb002b940b7fb69.exe
"C:\Users\Admin\AppData\Local\Temp\22eba1945ea7ccc18cb002b940b7fb69.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2964
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\system32\cmd.exe" /q /c "C:\Users\Admin\AppData\Local\Temp\Uvb..bat" > nul 2> nul
  2⤵
  - Deletes itself
  PID:2764

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\Uvb..bat

Filesize
210B

MD5
411c26b5de9ece1601396c737124d1e0

SHA1
5902821a6a14273f94c21e76e410e09f9d380522

SHA256
38b9ad437ee1a4b92f3f19f8a847df672091ab9339826de9702ad8a866856e96

SHA512
e18e963478e470400f50dee4c8ebe37a144ffa7f2db7cfc2945685c4113320ee09b9b9e88da352ac1b992db68e5aefdf799ccf92c4cf96a7d0af594ae639a4de

Download Submit
memory/2964-0-0x0000000000400000-0x000000000041D000-memory.dmp

Filesize
116KB

Download
memory/2964-1-0x0000000000230000-0x0000000000231000-memory.dmp

Filesize
4KB

Download
memory/2964-2-0x0000000000400000-0x000000000041D000-memory.dmp

Filesize
116KB

Download
memory/2964-3-0x0000000000400000-0x000000000041D000-memory.dmp

Filesize
116KB

Download
memory/2964-4-0x0000000000400000-0x000000000041D000-memory.dmp

Filesize
116KB

Download
memory/2964-6-0x0000000000400000-0x000000000041D000-memory.dmp

Filesize
116KB

Download