92e7a6704aeabbd2b930bef8357a6e8a9a604d051f87f873d44b4307b9a5ab56

Analysis

max time kernel
122s
max time network
163s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
29/12/2023, 18:36

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

00aa0cd9260de4761240e8503dd425bd.exe
Size

316KB
MD5

00aa0cd9260de4761240e8503dd425bd
SHA1

54bb7f4c6a7bfb2a13c9c1c79e76d3fbe10ed0cc
SHA256

92e7a6704aeabbd2b930bef8357a6e8a9a604d051f87f873d44b4307b9a5ab56
SHA512

cc8799d67914bb1507a3b6475bf79f8f70432b3f6485a65299cb54a563c7a19b23dc37464061b0818da9102b2591cc717a603fff565eb089ee8a2ae49cbf26ae
SSDEEP

6144:FUORK1ttbV3kSobTYZGiNdniCoh+KiEqeeBOgHoUD:FytbV3kSoXaLnTosl5pBOgIM

Score

7^/10

Malware Config

Signatures

Deletes itself 1 IoCs

pid	Process
3052	cmd.exe

Runs ping.exe 1 TTPs 1 IoCs

Remote System Discovery

T1018

pid	Process
760	PING.EXE

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
2960	00aa0cd9260de4761240e8503dd425bd.exe
2960	00aa0cd9260de4761240e8503dd425bd.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	2960	00aa0cd9260de4761240e8503dd425bd.exe

Suspicious use of WriteProcessMemory 6 IoCs

description	pid	Process	procid_target
PID 2960 wrote to memory of 3052	2960	00aa0cd9260de4761240e8503dd425bd.exe	27
PID 2960 wrote to memory of 3052	2960	00aa0cd9260de4761240e8503dd425bd.exe	27
PID 2960 wrote to memory of 3052	2960	00aa0cd9260de4761240e8503dd425bd.exe	27
PID 3052 wrote to memory of 760	3052	cmd.exe	29
PID 3052 wrote to memory of 760	3052	cmd.exe	29
PID 3052 wrote to memory of 760	3052	cmd.exe	29

C:\Users\Admin\AppData\Local\Temp\00aa0cd9260de4761240e8503dd425bd.exe
"C:\Users\Admin\AppData\Local\Temp\00aa0cd9260de4761240e8503dd425bd.exe"
1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2960
- C:\Windows\system32\cmd.exe
  cmd.exe /C ping 1.1.1.1 -n 1 -w 6000 > Nul & Del "C:\Users\Admin\AppData\Local\Temp\00aa0cd9260de4761240e8503dd425bd.exe"
  2⤵
  - Deletes itself
  - Suspicious use of WriteProcessMemory
  PID:3052
- - C:\Windows\system32\PING.EXE
    ping 1.1.1.1 -n 1 -w 6000
    3⤵
    - Runs ping.exe
    PID:760

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Remote System Discovery

T1018

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Windows 7 deprecation

Loading Replay Monitor...