f8d97b5f01f2cab7b0951b3c21b815230c97011dc7170c0be022feef32902dba

Analysis

max time kernel
117s
max time network
129s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
30/12/2023, 08:08

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

1304548fb10a31d3144189f700960708.exe
Size

488KB
MD5

1304548fb10a31d3144189f700960708
SHA1

37dba257e78806e298cd0d66ce878338e1c1b931
SHA256

f8d97b5f01f2cab7b0951b3c21b815230c97011dc7170c0be022feef32902dba
SHA512

479a21e474d1208f9b75edcf306f85fee581f14e5db66c45ea56a494d22d318567c2cf773e38caf02ff2e851e009247f7539b1174dff328931e37f65fb87520c
SSDEEP

12288:FytbV3kSoXaLnToslZb400MQkqcjWXsdzo3Tt:Eb5kSYaLTVlZb4/S5oio3p

Score

7^/10

Malware Config

Signatures

Deletes itself 1 IoCs

pid	Process
2412	cmd.exe

Runs ping.exe 1 TTPs 1 IoCs

Remote System Discovery

T1018

pid	Process
2712	PING.EXE

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
2092	1304548fb10a31d3144189f700960708.exe
2092	1304548fb10a31d3144189f700960708.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	2092	1304548fb10a31d3144189f700960708.exe

Suspicious use of WriteProcessMemory 6 IoCs

description	pid	Process	procid_target
PID 2092 wrote to memory of 2412	2092	1304548fb10a31d3144189f700960708.exe	28
PID 2092 wrote to memory of 2412	2092	1304548fb10a31d3144189f700960708.exe	28
PID 2092 wrote to memory of 2412	2092	1304548fb10a31d3144189f700960708.exe	28
PID 2412 wrote to memory of 2712	2412	cmd.exe	29
PID 2412 wrote to memory of 2712	2412	cmd.exe	29
PID 2412 wrote to memory of 2712	2412	cmd.exe	29

C:\Users\Admin\AppData\Local\Temp\1304548fb10a31d3144189f700960708.exe
"C:\Users\Admin\AppData\Local\Temp\1304548fb10a31d3144189f700960708.exe"
1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2092
- C:\Windows\system32\cmd.exe
  cmd.exe /C ping 1.1.1.1 -n 1 -w 6000 > Nul & Del "C:\Users\Admin\AppData\Local\Temp\1304548fb10a31d3144189f700960708.exe"
  2⤵
  - Deletes itself
  - Suspicious use of WriteProcessMemory
  PID:2412
- - C:\Windows\system32\PING.EXE
    ping 1.1.1.1 -n 1 -w 6000
    3⤵
    - Runs ping.exe
    PID:2712

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Remote System Discovery

T1018

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Windows 7 deprecation

Loading Replay Monitor...