b9b17f3f3cee1612b02ad24776705168656d1485a024443a282fac0360d451a8

Analysis

max time kernel
120s
max time network
124s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
31/12/2023, 07:31

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

2d7aeeaad7f09f43c59ae1ada7b2ee0e.exe
Size

316KB
MD5

2d7aeeaad7f09f43c59ae1ada7b2ee0e
SHA1

95c58bc05413f089e4b5f921ea38a383b6dd0c96
SHA256

b9b17f3f3cee1612b02ad24776705168656d1485a024443a282fac0360d451a8
SHA512

cb6ada509dc19ad1d21ed674ccd0169c8eff573209ce5fc9d196913e50b50074ca01913681ee2c9ba36c69f6e22449e0b4e97ac707d478016fbf4bf4ecbd3cd3
SSDEEP

6144:FUORK1ttbV3kSobTYZGiNdniCoh+KiE7V84OL:FytbV3kSoXaLnToslEmL

Score

7^/10

Malware Config

Signatures

Deletes itself 1 IoCs

pid	Process
936	cmd.exe

Runs ping.exe 1 TTPs 1 IoCs

Remote System Discovery

T1018

pid	Process
2072	PING.EXE

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
2252	2d7aeeaad7f09f43c59ae1ada7b2ee0e.exe
2252	2d7aeeaad7f09f43c59ae1ada7b2ee0e.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	2252	2d7aeeaad7f09f43c59ae1ada7b2ee0e.exe

Suspicious use of WriteProcessMemory 6 IoCs

description	pid	Process	procid_target
PID 2252 wrote to memory of 936	2252	2d7aeeaad7f09f43c59ae1ada7b2ee0e.exe	28
PID 2252 wrote to memory of 936	2252	2d7aeeaad7f09f43c59ae1ada7b2ee0e.exe	28
PID 2252 wrote to memory of 936	2252	2d7aeeaad7f09f43c59ae1ada7b2ee0e.exe	28
PID 936 wrote to memory of 2072	936	cmd.exe	30
PID 936 wrote to memory of 2072	936	cmd.exe	30
PID 936 wrote to memory of 2072	936	cmd.exe	30

C:\Users\Admin\AppData\Local\Temp\2d7aeeaad7f09f43c59ae1ada7b2ee0e.exe
"C:\Users\Admin\AppData\Local\Temp\2d7aeeaad7f09f43c59ae1ada7b2ee0e.exe"
1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2252
- C:\Windows\system32\cmd.exe
  cmd.exe /C ping 1.1.1.1 -n 1 -w 6000 > Nul & Del "C:\Users\Admin\AppData\Local\Temp\2d7aeeaad7f09f43c59ae1ada7b2ee0e.exe"
  2⤵
  - Deletes itself
  - Suspicious use of WriteProcessMemory
  PID:936
- - C:\Windows\system32\PING.EXE
    ping 1.1.1.1 -n 1 -w 6000
    3⤵
    - Runs ping.exe
    PID:2072

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Remote System Discovery

T1018

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Windows 7 deprecation

Loading Replay Monitor...