5977f3f747105ec8579e9c07560ef29fddce6fada39bd8e1f21199f832adcf6c

Analysis

max time kernel
120s
max time network
122s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
25/12/2023, 13:25

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

219ac194ce9eb97430034681f1c2cf5e.exe
Size

94KB
MD5

219ac194ce9eb97430034681f1c2cf5e
SHA1

692a86ca75a5cf83094aeaae3b9cf962c5fa71c1
SHA256

5977f3f747105ec8579e9c07560ef29fddce6fada39bd8e1f21199f832adcf6c
SHA512

45763c8950d5c0f7ca8979b85b450fd37dbac8c9fc3d43466b7172096a22dea7649268141bc57ee42d4348c6ed63a79950cc875db015d282f24fc9bea028c995
SSDEEP

1536:rfg+M2Y9oH+cpTKeyaI0Z/od8bDbRvU5yYeVYXrgITAGXBB3exYEjpepikFIy:rfgyY9oH+cTKGI0Z/oooeVYXrgI0GXW4

Score

7^/10

Malware Config

Signatures

Deletes itself 1 IoCs

pid	Process
2300	cmd.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1416 wrote to memory of 2300	1416	219ac194ce9eb97430034681f1c2cf5e.exe	29
PID 1416 wrote to memory of 2300	1416	219ac194ce9eb97430034681f1c2cf5e.exe	29
PID 1416 wrote to memory of 2300	1416	219ac194ce9eb97430034681f1c2cf5e.exe	29
PID 1416 wrote to memory of 2300	1416	219ac194ce9eb97430034681f1c2cf5e.exe	29

C:\Users\Admin\AppData\Local\Temp\219ac194ce9eb97430034681f1c2cf5e.exe
"C:\Users\Admin\AppData\Local\Temp\219ac194ce9eb97430034681f1c2cf5e.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1416
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\system32\cmd.exe" /q /c "C:\Users\Admin\AppData\Local\Temp\Qwf..bat" > nul 2> nul
  2⤵
  - Deletes itself
  PID:2300

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\Qwf..bat

Filesize
210B

MD5
030d2c231c85c4d66a53d3978b2f135e

SHA1
e3024ea9edbe385394c8711efd0e947704f6bf08

SHA256
f1d09f6a533f053dd80cfac3272bc6b636d7242cf8c499d9043147a9528b4d25

SHA512
130695edf46a68308176e0546f0c88c2b81f7c72407a6f9591579004902306698863ec73066344c9196888f3402d1efdce37df7e35bf2b8dd208912f49f1ff37

Download Submit
memory/1416-1-0x0000000000230000-0x0000000000231000-memory.dmp

Filesize
4KB

Download
memory/1416-0-0x0000000000400000-0x000000000041D000-memory.dmp

Filesize
116KB

Download
memory/1416-2-0x0000000000400000-0x000000000041D000-memory.dmp

Filesize
116KB

Download
memory/1416-4-0x0000000000400000-0x000000000041D000-memory.dmp

Filesize
116KB

Download