943c8ceb2acb602a4ec3be97170e7ce8eb13e0660df01e3e220e5b5e4832f432

Analysis

max time kernel
122s
max time network
152s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
05/01/2024, 21:57

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

4488e726cbd5a44c393dca5cac3fb18a.exe
Size

1.6MB
MD5

4488e726cbd5a44c393dca5cac3fb18a
SHA1

7294f58aa3c2510508a5f83e86e6d79308084c80
SHA256

943c8ceb2acb602a4ec3be97170e7ce8eb13e0660df01e3e220e5b5e4832f432
SHA512

8f302c7c44d1d46321d5f65e6ba77d4f2ecb6ce02fb449e31f078c7fe5f9727af560288067786f1cefbf32d2ed99e4405c184887d2966ff043e582ec55cf820d
SSDEEP

49152:Eb5k2L5SxoZL1Sql5koNwDfRsmp4SywQp1R5esLbE2jXZiHu:EcqZL1bl5BSbRFrepI8bXpAu

Score

7^/10

Malware Config

Signatures

Deletes itself 1 IoCs

pid	Process
2308	cmd.exe

Runs ping.exe 1 TTPs 1 IoCs

Remote System Discovery

T1018

pid	Process
2068	PING.EXE

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
2912	4488e726cbd5a44c393dca5cac3fb18a.exe
2912	4488e726cbd5a44c393dca5cac3fb18a.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	2912	4488e726cbd5a44c393dca5cac3fb18a.exe

Suspicious use of WriteProcessMemory 6 IoCs

description	pid	Process	procid_target
PID 2912 wrote to memory of 2308	2912	4488e726cbd5a44c393dca5cac3fb18a.exe	28
PID 2912 wrote to memory of 2308	2912	4488e726cbd5a44c393dca5cac3fb18a.exe	28
PID 2912 wrote to memory of 2308	2912	4488e726cbd5a44c393dca5cac3fb18a.exe	28
PID 2308 wrote to memory of 2068	2308	cmd.exe	30
PID 2308 wrote to memory of 2068	2308	cmd.exe	30
PID 2308 wrote to memory of 2068	2308	cmd.exe	30

C:\Users\Admin\AppData\Local\Temp\4488e726cbd5a44c393dca5cac3fb18a.exe
"C:\Users\Admin\AppData\Local\Temp\4488e726cbd5a44c393dca5cac3fb18a.exe"
1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2912
- C:\Windows\system32\cmd.exe
  cmd.exe /C ping 1.1.1.1 -n 1 -w 6000 > Nul & Del "C:\Users\Admin\AppData\Local\Temp\4488e726cbd5a44c393dca5cac3fb18a.exe"
  2⤵
  - Deletes itself
  - Suspicious use of WriteProcessMemory
  PID:2308
- - C:\Windows\system32\PING.EXE
    ping 1.1.1.1 -n 1 -w 6000
    3⤵
    - Runs ping.exe
    PID:2068

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Remote System Discovery

T1018

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Windows 7 deprecation

Loading Replay Monitor...