3f8417d177f1d5746a9f8fdff954e75792682e6d78f2cc8920d2b84e55a62982

Analysis

max time kernel
120s
max time network
124s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
26/12/2023, 10:10

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

66326ca3d7537b19e91d30ee70802d39.exe
Size

91KB
MD5

66326ca3d7537b19e91d30ee70802d39
SHA1

5b345b69dc4c7057774e494350906e1877a46f24
SHA256

3f8417d177f1d5746a9f8fdff954e75792682e6d78f2cc8920d2b84e55a62982
SHA512

b353a57099a58bd484b8fb6499ed3dcc59d1063ca39027ccb68fd42e739259c252c43c3ac1e88d805a0798ddb1a334dafa542ce4528c33429b7b69b976847eb7
SSDEEP

1536:nlqmbxDIFoprhcZdmF8JC3IDS2E3YHfDqqr/XaNNSykFI+L:nlt9DL9MdmYQIeIHOqr/nykFIq

Score

7^/10

Malware Config

Signatures

Deletes itself 1 IoCs

pid	Process
2956	cmd.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2352 wrote to memory of 2956	2352	66326ca3d7537b19e91d30ee70802d39.exe	27
PID 2352 wrote to memory of 2956	2352	66326ca3d7537b19e91d30ee70802d39.exe	27
PID 2352 wrote to memory of 2956	2352	66326ca3d7537b19e91d30ee70802d39.exe	27
PID 2352 wrote to memory of 2956	2352	66326ca3d7537b19e91d30ee70802d39.exe	27

C:\Users\Admin\AppData\Local\Temp\66326ca3d7537b19e91d30ee70802d39.exe
"C:\Users\Admin\AppData\Local\Temp\66326ca3d7537b19e91d30ee70802d39.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2352
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\system32\cmd.exe" /q /c "C:\Users\Admin\AppData\Local\Temp\Bpj..bat" > nul 2> nul
  2⤵
  - Deletes itself
  PID:2956

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\Bpj..bat

Filesize
210B

MD5
a2da8ca20625abbb61d4a3fe08c50c30

SHA1
9fd986cb8fbdfdeb94ce17f81f7a914c39f7266a

SHA256
210db2de00e58f1a9fba8bd427b3f654fe78c50b0c8c1b1da6395e5ed4fcc95c

SHA512
2162f1441850e133315a982f957f12b3bdb7034a9f1702baff98c92fc87fffc1953365d465d10b08e5c31cb3c8c768c74ec9be2275c22e6182c78dc28fe21304

Download Submit
memory/2352-0-0x0000000000400000-0x000000000041B000-memory.dmp

Filesize
108KB

Download
memory/2352-2-0x0000000000400000-0x000000000041B000-memory.dmp

Filesize
108KB

Download
memory/2352-1-0x00000000002E0000-0x00000000002E1000-memory.dmp

Filesize
4KB

Download
memory/2352-3-0x0000000000400000-0x000000000041B000-memory.dmp

Filesize
108KB

Download
memory/2352-4-0x0000000000400000-0x000000000041B000-memory.dmp

Filesize
108KB

Download
memory/2352-6-0x0000000000400000-0x000000000041B000-memory.dmp

Filesize
108KB

Download
memory/2352-7-0x0000000000400000-0x000000000041B000-memory.dmp

Filesize
108KB

Download