134066c6e75231f94f210895422482afe02a203df790198982757d67feb85665

Analysis

max time kernel
120s
max time network
130s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
30/12/2023, 07:23

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

120cc2c3c72449100dbc7fa19451db52.exe
Size

474KB
MD5

120cc2c3c72449100dbc7fa19451db52
SHA1

6739850fe02dad86123cf8dbef998a23b3360b53
SHA256

134066c6e75231f94f210895422482afe02a203df790198982757d67feb85665
SHA512

e7e206ccf75f57ca7d5316dbe0bcee5742df92677882644652f61d08d812ff57a9021f01a0f4e2e080003437a515a632965a001643816b92f23e2e79dfb2a277
SSDEEP

6144:z8jIUFOBIzofbx4vE4YFBKRdag0/gOTNP6uIq9LmKVebU3VfMnmssdLQYoWvDH:zoOIoT/xtT9Lp8bU3NEso0H

Score

7^/10

Malware Config

Signatures

Deletes itself 1 IoCs

pid	Process
3064	cmd.exe

Runs ping.exe 1 TTPs 1 IoCs

Remote System Discovery

T1018

pid	Process
2912	PING.EXE

Suspicious use of WriteProcessMemory 8 IoCs

description	pid	Process	procid_target
PID 2804 wrote to memory of 3064	2804	120cc2c3c72449100dbc7fa19451db52.exe	32
PID 2804 wrote to memory of 3064	2804	120cc2c3c72449100dbc7fa19451db52.exe	32
PID 2804 wrote to memory of 3064	2804	120cc2c3c72449100dbc7fa19451db52.exe	32
PID 2804 wrote to memory of 3064	2804	120cc2c3c72449100dbc7fa19451db52.exe	32
PID 3064 wrote to memory of 2912	3064	cmd.exe	35
PID 3064 wrote to memory of 2912	3064	cmd.exe	35
PID 3064 wrote to memory of 2912	3064	cmd.exe	35
PID 3064 wrote to memory of 2912	3064	cmd.exe	35

C:\Users\Admin\AppData\Local\Temp\120cc2c3c72449100dbc7fa19451db52.exe
"C:\Users\Admin\AppData\Local\Temp\120cc2c3c72449100dbc7fa19451db52.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2804
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /C ping 1.1.1.1 -n 1 -w 3000 > Nul & Del "C:\Users\Admin\AppData\Local\Temp\120cc2c3c72449100dbc7fa19451db52.exe"
  2⤵
  - Deletes itself
  - Suspicious use of WriteProcessMemory
  PID:3064
- - C:\Windows\SysWOW64\PING.EXE
    ping 1.1.1.1 -n 1 -w 3000
    3⤵
    - Runs ping.exe
    PID:2912

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Remote System Discovery

T1018

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2804-0-0x0000000000400000-0x0000000000478000-memory.dmp

Filesize
480KB

Download
memory/2804-1-0x0000000000400000-0x0000000000478000-memory.dmp

Filesize
480KB

Download
memory/2804-2-0x0000000000400000-0x0000000000478000-memory.dmp

Filesize
480KB

Download
memory/2804-4-0x0000000000400000-0x0000000000478000-memory.dmp

Filesize
480KB

Download