da74221276f4da306ffca5dc827ae41473e13b98a69a936b1ee9ba66b3dfea03

Analysis

max time kernel
122s
max time network
127s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
04-01-2024 20:18

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

41d0564dcaf0e4ee2632231d68ae0f5a.exe
Size

316KB
MD5

41d0564dcaf0e4ee2632231d68ae0f5a
SHA1

3781e6ac5847683693d7324a22de1966a69eb8a2
SHA256

da74221276f4da306ffca5dc827ae41473e13b98a69a936b1ee9ba66b3dfea03
SHA512

d2f54782d77ecd716e7f19e9b123fca9a4ee59e1d07afb97743d62ce192ec79ffe5225fd8a3524dd8c833c555870bbed6f789f94a13403ec4beb5fd5979297df
SSDEEP

6144:FUORK1ttbV3kSobTYZGiNdniCoh+KiEVsamwDSHit:FytbV3kSoXaLnToslEVjOCt

Score

7^/10

Malware Config

Signatures

Deletes itself 1 IoCs

pid	Process
2196	cmd.exe

Runs ping.exe 1 TTPs 1 IoCs

Remote System Discovery

T1018

pid	Process
2336	PING.EXE

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
1752	41d0564dcaf0e4ee2632231d68ae0f5a.exe
1752	41d0564dcaf0e4ee2632231d68ae0f5a.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	1752	41d0564dcaf0e4ee2632231d68ae0f5a.exe

Suspicious use of WriteProcessMemory 6 IoCs

description	pid	Process	procid_target
PID 1752 wrote to memory of 2196	1752	41d0564dcaf0e4ee2632231d68ae0f5a.exe	16
PID 1752 wrote to memory of 2196	1752	41d0564dcaf0e4ee2632231d68ae0f5a.exe	16
PID 1752 wrote to memory of 2196	1752	41d0564dcaf0e4ee2632231d68ae0f5a.exe	16
PID 2196 wrote to memory of 2336	2196	cmd.exe	15
PID 2196 wrote to memory of 2336	2196	cmd.exe	15
PID 2196 wrote to memory of 2336	2196	cmd.exe	15

C:\Windows\system32\PING.EXE
ping 1.1.1.1 -n 1 -w 6000
1⤵
- Runs ping.exe
PID:2336

C:\Windows\system32\cmd.exe
cmd.exe /C ping 1.1.1.1 -n 1 -w 6000 > Nul & Del "C:\Users\Admin\AppData\Local\Temp\41d0564dcaf0e4ee2632231d68ae0f5a.exe"
1⤵
- Deletes itself
- Suspicious use of WriteProcessMemory
PID:2196

C:\Users\Admin\AppData\Local\Temp\41d0564dcaf0e4ee2632231d68ae0f5a.exe
"C:\Users\Admin\AppData\Local\Temp\41d0564dcaf0e4ee2632231d68ae0f5a.exe"
1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1752

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Remote System Discovery

T1018

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads