2a84648d6ad98cfc58e169b57be3620bccb36106d5d705085a7c38c12e7432a1

Analysis

max time kernel
119s
max time network
130s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
04/01/2024, 17:54

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

41882717ffd6cdb8c008ebcfec55ee67.exe
Size

137KB
MD5

41882717ffd6cdb8c008ebcfec55ee67
SHA1

6e3a8fefe7072427d30c811387a6fc874f665295
SHA256

2a84648d6ad98cfc58e169b57be3620bccb36106d5d705085a7c38c12e7432a1
SHA512

11822381f890f4e3bd670f405289d9e1d392417bb864629572a4820bc004cd22cc2727f99e6c456caa1f93db196bcd0992b7f332474e0c712a99c3174d3a8a0e
SSDEEP

3072:KbPN+Vm691ASZ4L016HxawPQrwmy5MmtiJCMAiTBtPiSfL/U:KiJZJ1Gx9uwmy7g0biTj

Score

7^/10

Malware Config

Signatures

Deletes itself 1 IoCs

pid	Process
1732	cmd.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2104 wrote to memory of 1732	2104	41882717ffd6cdb8c008ebcfec55ee67.exe	28
PID 2104 wrote to memory of 1732	2104	41882717ffd6cdb8c008ebcfec55ee67.exe	28
PID 2104 wrote to memory of 1732	2104	41882717ffd6cdb8c008ebcfec55ee67.exe	28
PID 2104 wrote to memory of 1732	2104	41882717ffd6cdb8c008ebcfec55ee67.exe	28

C:\Users\Admin\AppData\Local\Temp\41882717ffd6cdb8c008ebcfec55ee67.exe
"C:\Users\Admin\AppData\Local\Temp\41882717ffd6cdb8c008ebcfec55ee67.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2104
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\system32\cmd.exe" /q /c "C:\Users\Admin\AppData\Local\Temp\Tdz..bat" > nul 2> nul
  2⤵
  - Deletes itself
  PID:1732

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\Tdz..bat

Filesize
210B

MD5
c0b3cea560b2e5f7e10ede4b8dcdbf39

SHA1
7d996207cf5ef499ff0576e1a1cd08bec0926f51

SHA256
799d29afcac741bbfe272e2185e6f1ae0e0e535188ed4cc81cb9e738d9cd2360

SHA512
07b151d9d0bae7dee62e92a1657760cc16a5e2a497ec35affbf56e8acb5b8087397fa58a620f0ee2aedf210a78eb2e2757914584779734c61728f0ec24fbcc7a

Download Submit
memory/2104-0-0x0000000000220000-0x000000000024F000-memory.dmp

Filesize
188KB

Download
memory/2104-1-0x0000000000220000-0x000000000024F000-memory.dmp

Filesize
188KB

Download
memory/2104-2-0x0000000000400000-0x0000000000425000-memory.dmp

Filesize
148KB

Download
memory/2104-4-0x0000000000400000-0x0000000000425000-memory.dmp

Filesize
148KB

Download