05c63e922df0de27862988ce4b7ff383820d2c73b4f68f08102be863d0dc4fef

Analysis

max time kernel
121s
max time network
125s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
28/12/2023, 20:33

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

f632c98abc2ac7aacacb063deab92ae2.exe
Size

76KB
MD5

f632c98abc2ac7aacacb063deab92ae2
SHA1

03d464a70e8ca6ceef1731c754b34456a7e135dd
SHA256

05c63e922df0de27862988ce4b7ff383820d2c73b4f68f08102be863d0dc4fef
SHA512

62145e13e797b0d8cf268f647295d3c6342a2982e0461fd7306e84c66008309439e097ae1e0ace79d68c4a51444cb44db3c4ee7d5ef5972f8189c495e4544eca
SSDEEP

1536:fnd47nXPeFCi0Jn+mIeTs3xEXf6/Dj6r/q97vKux7N+bpAn1gAL:/dk9Q8sSv6D2rCvXx5+beL

Score

7^/10

Malware Config

Signatures

Deletes itself 1 IoCs

pid	Process
2692	cmd.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2400 wrote to memory of 2692	2400	f632c98abc2ac7aacacb063deab92ae2.exe	28
PID 2400 wrote to memory of 2692	2400	f632c98abc2ac7aacacb063deab92ae2.exe	28
PID 2400 wrote to memory of 2692	2400	f632c98abc2ac7aacacb063deab92ae2.exe	28
PID 2400 wrote to memory of 2692	2400	f632c98abc2ac7aacacb063deab92ae2.exe	28

C:\Users\Admin\AppData\Local\Temp\f632c98abc2ac7aacacb063deab92ae2.exe
"C:\Users\Admin\AppData\Local\Temp\f632c98abc2ac7aacacb063deab92ae2.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2400
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\system32\cmd.exe" /q /c "C:\Users\Admin\AppData\Local\Temp\Fqj..bat" > nul 2> nul
  2⤵
  - Deletes itself
  PID:2692

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\Fqj..bat

Filesize
210B

MD5
51194fdb6f7922dfc8ce23f3ce1ee8d1

SHA1
9f6d1ac400237b804ed4e5a5c3d3cabd4862bee0

SHA256
7e9c8dd370a9850686ee358fe2988e5d93fab779cea0907f9e64c4f9be88b29e

SHA512
d0dc0aaed5e003deec6d1483b8a67a2fdc6e4fa86bf6b32987c7c09a965e086a4f79c799fdceea84bee6133f243e68e7e01acb916a3f70bf4eaa434f56d3b709

Download Submit
memory/2400-0-0x0000000000400000-0x0000000000418000-memory.dmp

Filesize
96KB

Download
memory/2400-1-0x0000000000230000-0x0000000000231000-memory.dmp

Filesize
4KB

Download
memory/2400-2-0x0000000000400000-0x0000000000418000-memory.dmp

Filesize
96KB

Download
memory/2400-3-0x0000000000400000-0x0000000000418000-memory.dmp

Filesize
96KB

Download
memory/2400-5-0x0000000000400000-0x0000000000418000-memory.dmp

Filesize
96KB

Download