Analysis
-
max time kernel
119s -
max time network
122s -
platform
windows7_x64 -
resource
win7-20231215-en -
resource tags
arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system -
submitted
30-12-2023 09:05
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
14106b65fdc741d498a533f857d0ab87.exe
Resource
win7-20231215-en
windows7-x64
5 signatures
150 seconds
Behavioral task
behavioral2
Sample
14106b65fdc741d498a533f857d0ab87.exe
Resource
win10v2004-20231215-en
windows10-2004-x64
4 signatures
150 seconds
General
-
Target
14106b65fdc741d498a533f857d0ab87.exe
-
Size
316KB
-
MD5
14106b65fdc741d498a533f857d0ab87
-
SHA1
161e9339f1f339356089de437cded45fc4ce8fb6
-
SHA256
dcadf8ca7902c37c957aa9718206a878283c118f759bdbc3254485928152a9dc
-
SHA512
aaab210bcfcedf040e98ac8e0c494d1507262b5c26af1f6e5b1dd93c1e0caf5ad62a39aa9071fa6d7c71d5561068a1fb1e848427b5f0aeb33e03bd5370f346f6
-
SSDEEP
6144:FUORK1ttbV3kSobTYZGiNdniCoh+KiE7K8V01gibF87Z:FytbV3kSoXaLnToslOK8CGibK7Z
Score
7/10
Malware Config
Signatures
-
Deletes itself 1 IoCs
pid Process 3040 cmd.exe -
Runs ping.exe 1 TTPs 1 IoCs
pid Process 2196 PING.EXE -
Suspicious behavior: EnumeratesProcesses 2 IoCs
pid Process 2980 14106b65fdc741d498a533f857d0ab87.exe 2980 14106b65fdc741d498a533f857d0ab87.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
description pid Process Token: SeDebugPrivilege 2980 14106b65fdc741d498a533f857d0ab87.exe -
Suspicious use of WriteProcessMemory 6 IoCs
description pid Process procid_target PID 2980 wrote to memory of 3040 2980 14106b65fdc741d498a533f857d0ab87.exe 28 PID 2980 wrote to memory of 3040 2980 14106b65fdc741d498a533f857d0ab87.exe 28 PID 2980 wrote to memory of 3040 2980 14106b65fdc741d498a533f857d0ab87.exe 28 PID 3040 wrote to memory of 2196 3040 cmd.exe 30 PID 3040 wrote to memory of 2196 3040 cmd.exe 30 PID 3040 wrote to memory of 2196 3040 cmd.exe 30
Processes
-
C:\Users\Admin\AppData\Local\Temp\14106b65fdc741d498a533f857d0ab87.exe"C:\Users\Admin\AppData\Local\Temp\14106b65fdc741d498a533f857d0ab87.exe"1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2980 -
C:\Windows\system32\cmd.execmd.exe /C ping 1.1.1.1 -n 1 -w 6000 > Nul & Del "C:\Users\Admin\AppData\Local\Temp\14106b65fdc741d498a533f857d0ab87.exe"2⤵
- Deletes itself
- Suspicious use of WriteProcessMemory
PID:3040 -
C:\Windows\system32\PING.EXEping 1.1.1.1 -n 1 -w 60003⤵
- Runs ping.exe
PID:2196
-
-