3ec8ee0fcf33f361a65452a7e23982f54ecc4563960c6e7df0302f3596c7f6d9

Analysis

max time kernel
118s
max time network
119s
platform
windows7_x64
resource
win7-20231129-en
resource tags

arch:x64arch:x86image:win7-20231129-enlocale:en-usos:windows7-x64system
submitted
30/12/2023, 21:14

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

1ca3ea0e1447bec91283d2d6c84e841d.exe
Size

5.1MB
MD5

1ca3ea0e1447bec91283d2d6c84e841d
SHA1

19c6a779e758ed59122004c10fb7ab6f78ce3a57
SHA256

3ec8ee0fcf33f361a65452a7e23982f54ecc4563960c6e7df0302f3596c7f6d9
SHA512

bd9ea793037cdbe6f574f09062ee5e26419f5887f868a1a0c200a41a0f9e33340de7aff3f555961d96cc8cf53c85d1ce6aa1b11366e0ed95de18781be9cd3f2f
SSDEEP

98304:EFse0ccAHiHyjvmwAzTZ1jEuZ5iacre4IGrpxSyG+MMtRouwwfQoYVgfd9UB:EWvACHyzmwcnjLZEd/vSC7cXoYgfbUB

Score

7^/10

Malware Config

Signatures

Deletes itself 1 IoCs

pid	Process
1936	cmd.exe

Runs ping.exe 1 TTPs 1 IoCs

Remote System Discovery

T1018

pid	Process
1860	PING.EXE

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
2436	1ca3ea0e1447bec91283d2d6c84e841d.exe
2436	1ca3ea0e1447bec91283d2d6c84e841d.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	2436	1ca3ea0e1447bec91283d2d6c84e841d.exe

Suspicious use of WriteProcessMemory 6 IoCs

description	pid	Process	procid_target
PID 2436 wrote to memory of 1936	2436	1ca3ea0e1447bec91283d2d6c84e841d.exe	27
PID 2436 wrote to memory of 1936	2436	1ca3ea0e1447bec91283d2d6c84e841d.exe	27
PID 2436 wrote to memory of 1936	2436	1ca3ea0e1447bec91283d2d6c84e841d.exe	27
PID 1936 wrote to memory of 1860	1936	cmd.exe	25
PID 1936 wrote to memory of 1860	1936	cmd.exe	25
PID 1936 wrote to memory of 1860	1936	cmd.exe	25

C:\Users\Admin\AppData\Local\Temp\1ca3ea0e1447bec91283d2d6c84e841d.exe
"C:\Users\Admin\AppData\Local\Temp\1ca3ea0e1447bec91283d2d6c84e841d.exe"
1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2436
- C:\Windows\system32\cmd.exe
  cmd.exe /C ping 1.1.1.1 -n 1 -w 6000 > Nul & Del "C:\Users\Admin\AppData\Local\Temp\1ca3ea0e1447bec91283d2d6c84e841d.exe"
  2⤵
  - Deletes itself
  - Suspicious use of WriteProcessMemory
  PID:1936

C:\Windows\system32\PING.EXE
ping 1.1.1.1 -n 1 -w 6000
1⤵
- Runs ping.exe
PID:1860

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Remote System Discovery

T1018

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads