3e11ce5f2c423c6da7b6822d5cf2765bd0e11adc818f51318cb371c790ac2be2

Analysis

max time kernel
117s
max time network
122s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
30/12/2023, 21:24

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

1ce4e6cb42e7695339d7cf778c1118d0.exe
Size

112KB
MD5

1ce4e6cb42e7695339d7cf778c1118d0
SHA1

8349d32d9f9d7dd2ff3b115c9f668e5cbcdc7f1c
SHA256

3e11ce5f2c423c6da7b6822d5cf2765bd0e11adc818f51318cb371c790ac2be2
SHA512

0e052d832fcfde554539bbfc5ae1cf13bdadbb77ff3ef64308e9f913df5b90e06cc5004e5d0843afd85d0a1e7500dd4208b2a3adea7b257832a1a4506f032452
SSDEEP

1536:6CGzIQgjl7TChZvuW12aAhsbUFX2PQvK7KdzBvlTx+5lucY/c0w2WwUfq4phBel7:sJgVQkfGHPwdllY32MHXBe0I0FIb

Score

7^/10

Malware Config

Signatures

Deletes itself 1 IoCs

pid	Process
2464	cmd.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
2672	1ce4e6cb42e7695339d7cf778c1118d0.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2672 wrote to memory of 2464	2672	1ce4e6cb42e7695339d7cf778c1118d0.exe	28
PID 2672 wrote to memory of 2464	2672	1ce4e6cb42e7695339d7cf778c1118d0.exe	28
PID 2672 wrote to memory of 2464	2672	1ce4e6cb42e7695339d7cf778c1118d0.exe	28
PID 2672 wrote to memory of 2464	2672	1ce4e6cb42e7695339d7cf778c1118d0.exe	28

C:\Users\Admin\AppData\Local\Temp\1ce4e6cb42e7695339d7cf778c1118d0.exe
"C:\Users\Admin\AppData\Local\Temp\1ce4e6cb42e7695339d7cf778c1118d0.exe"
1⤵
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of WriteProcessMemory
PID:2672
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\system32\cmd.exe" /q /c "C:\Users\Admin\AppData\Local\Temp\Bcb..bat" > nul 2> nul
  2⤵
  - Deletes itself
  PID:2464

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\Bcb..bat

Filesize
210B

MD5
5e65d8fc90e9906fb49b03b0c91b412f

SHA1
ace89cbebe88a58c13eef918dd8e8e5fbaebd2ab

SHA256
66871b682cb238ac17145b73afad8948dde648d1eb5b3cf8e6606d1e65cae1a2

SHA512
86bcc1d65d9c0673ba3dbac50a5056e3f6309f9398a36bac848c5888dc0ab00c4961644b414e86531ff801d0a1d073713c1aeac32d0e5cf62a856f2b43f1b442

Download Submit
memory/2672-0-0x0000000000400000-0x0000000000421000-memory.dmp

Filesize
132KB

Download
memory/2672-1-0x00000000002B0000-0x00000000002B1000-memory.dmp

Filesize
4KB

Download
memory/2672-2-0x0000000000400000-0x0000000000421000-memory.dmp

Filesize
132KB

Download
memory/2672-3-0x0000000000400000-0x0000000000421000-memory.dmp

Filesize
132KB

Download
memory/2672-4-0x0000000000400000-0x0000000000421000-memory.dmp

Filesize
132KB

Download
memory/2672-6-0x0000000000400000-0x0000000000421000-memory.dmp

Filesize
132KB

Download