7154a2dd7e513cd9f5668b21be7e86470597549fab8b05511f03bfcfe1dbfda0

Analysis

max time kernel
122s
max time network
137s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
26/12/2023, 11:24

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

6a92f32afcfc1ae677ca45c7f7e03a35.exe
Size

4KB
MD5

6a92f32afcfc1ae677ca45c7f7e03a35
SHA1

a0fa4a864b3aeaf74044a3432aca5cead03f0af3
SHA256

7154a2dd7e513cd9f5668b21be7e86470597549fab8b05511f03bfcfe1dbfda0
SHA512

a61bd2a3dd63ddeddbd0fa161df022b833f853c712b0def551b1188c51925433e556fe38eb066f1d422445aaef5c88525a07ca49ae5b79634106303e2aae4b56
SSDEEP

96:WCWn0oUN6/X1nuXXRfb1V1mBEbnrYcr18SicEx:0tFsBfbL1q6rNLbEx

Score

8^/10

evasion

Malware Config

Signatures

Sets file to hidden 1 TTPs 2 IoCs

Modifies file attributes to stop it showing in Explorer etc.

evasion

Hidden Files and Directories

T1564.001

pid	Process
2652	attrib.exe
2532	attrib.exe

Deletes itself 1 IoCs

pid	Process
2584	cmd.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
2512	6a92f32afcfc1ae677ca45c7f7e03a35.exe

Suspicious use of WriteProcessMemory 12 IoCs

description	pid	Process	procid_target
PID 2512 wrote to memory of 2584	2512	6a92f32afcfc1ae677ca45c7f7e03a35.exe	31
PID 2512 wrote to memory of 2584	2512	6a92f32afcfc1ae677ca45c7f7e03a35.exe	31
PID 2512 wrote to memory of 2584	2512	6a92f32afcfc1ae677ca45c7f7e03a35.exe	31
PID 2512 wrote to memory of 2584	2512	6a92f32afcfc1ae677ca45c7f7e03a35.exe	31
PID 2584 wrote to memory of 2652	2584	cmd.exe	33
PID 2584 wrote to memory of 2652	2584	cmd.exe	33
PID 2584 wrote to memory of 2652	2584	cmd.exe	33
PID 2584 wrote to memory of 2652	2584	cmd.exe	33
PID 2584 wrote to memory of 2532	2584	cmd.exe	34
PID 2584 wrote to memory of 2532	2584	cmd.exe	34
PID 2584 wrote to memory of 2532	2584	cmd.exe	34
PID 2584 wrote to memory of 2532	2584	cmd.exe	34

Views/modifies file attributes 1 TTPs 2 IoCs

evasion

Hidden Files and Directories

T1564.001

pid	Process
2652	attrib.exe
2532	attrib.exe

C:\Users\Admin\AppData\Local\Temp\6a92f32afcfc1ae677ca45c7f7e03a35.exe
"C:\Users\Admin\AppData\Local\Temp\6a92f32afcfc1ae677ca45c7f7e03a35.exe"
1⤵
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2512
- C:\Windows\SysWOW64\cmd.exe
  cmd /c C:\Users\Admin\AppData\Local\Temp\piaoyao.bat
  2⤵
  - Deletes itself
  - Suspicious use of WriteProcessMemory
  PID:2584
- - C:\Windows\SysWOW64\attrib.exe
    attrib +r +s +h d:\AUTORUN.INf
    3⤵
    - Sets file to hidden
    - Views/modifies file attributes
    PID:2652
- - C:\Windows\SysWOW64\attrib.exe
    attrib +r +s +h d:\piaoyao.exe
    3⤵
    - Sets file to hidden
    - Views/modifies file attributes
    PID:2532

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Hide Artifacts

T1564

Hidden Files and Directories

T1564.001

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\piaoyao.bat

Filesize
268B

MD5
97251764447d01169bfc77f18b5c936e

SHA1
acec3008300810d43115c368a0b35fa5b90a7c9b

SHA256
60f076ff7618a1ac122378ee4eb4c21ca8773dd2f64f3de1cd01cc2c5fd898c5

SHA512
5c7ea2edecb2ad50879a71ad5d491c28cbf3253840c12e3ba9de5c40c6225697847785012046d6c73ae9f077888d0fe14cb55ad9872b7a323dc3eee0b7de2ad6

Download Submit
C:\Users\Admin\AppData\Local\Temp\piaoyao.inf

Filesize
162B

MD5
63cd8ec92896833508a49fbf91ee501f

SHA1
806d802843cc03e4f067549f87fd21bdeb2add06

SHA256
9b43cbc6990e7d136e6d1412d7337eff76e6fce23a5ea8243aab86ca45539dbe

SHA512
6fa31ebc87dba137c0cbd0c339e8daccd492da05bd38164824b03e3da43593ff6ba55a3d4d2f9d4826c5a986cb9f9330b330be2c2bfccc8e90c677bdeff6e635

Download Submit
memory/2512-0-0x0000000000400000-0x0000000000406FAB-memory.dmp

Filesize
27KB

Download
memory/2512-2-0x0000000000400000-0x0000000000406FAB-memory.dmp

Filesize
27KB

Download
memory/2512-12-0x0000000000400000-0x0000000000406FAB-memory.dmp

Filesize
27KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads