66e3ef15357195ffb3d890b8ba4818826c95132a76f93f932fea3ad641872580

Analysis

max time kernel
121s
max time network
121s
platform
windows7_x64
resource
win7-20231129-en
resource tags

arch:x64arch:x86image:win7-20231129-enlocale:en-usos:windows7-x64system
submitted
09-01-2024 03:59

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

4d47d1621e9a1ad8a6ef7db9affbe2dc.exe
Size

94KB
MD5

4d47d1621e9a1ad8a6ef7db9affbe2dc
SHA1

c1585d7c6c0bc7a160e8932250b510a2a70cd3b9
SHA256

66e3ef15357195ffb3d890b8ba4818826c95132a76f93f932fea3ad641872580
SHA512

f79a385fc8f37ee5aee024e710713cb266af5de629e498107400f52d70aceef1a5fda3aa0fe67b1cb4c3468d9fa672bfb4652a738540c8d2141c01d5d7f5d2e9
SSDEEP

1536:jfg+M2Y9oH+cpTKeyaI0Z/od8bDbRvU5yYeVYXrgITAGXBB3exYEjpepikFIy:jfgyY9oH+cTKGI0Z/oooeVYXrgI0GXW4

Score

7^/10

Malware Config

Signatures

Deletes itself 1 IoCs

pid	Process
1856	cmd.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 780 wrote to memory of 1856	780	4d47d1621e9a1ad8a6ef7db9affbe2dc.exe	29
PID 780 wrote to memory of 1856	780	4d47d1621e9a1ad8a6ef7db9affbe2dc.exe	29
PID 780 wrote to memory of 1856	780	4d47d1621e9a1ad8a6ef7db9affbe2dc.exe	29
PID 780 wrote to memory of 1856	780	4d47d1621e9a1ad8a6ef7db9affbe2dc.exe	29

C:\Users\Admin\AppData\Local\Temp\4d47d1621e9a1ad8a6ef7db9affbe2dc.exe
"C:\Users\Admin\AppData\Local\Temp\4d47d1621e9a1ad8a6ef7db9affbe2dc.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:780
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\system32\cmd.exe" /q /c "C:\Users\Admin\AppData\Local\Temp\Atp..bat" > nul 2> nul
  2⤵
  - Deletes itself
  PID:1856

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/780-1-0x0000000000240000-0x0000000000241000-memory.dmp

Filesize
4KB

Download
memory/780-0-0x0000000000400000-0x000000000041D000-memory.dmp

Filesize
116KB

Download
memory/780-2-0x0000000000400000-0x000000000041D000-memory.dmp

Filesize
116KB

Download
memory/780-4-0x0000000000400000-0x000000000041D000-memory.dmp

Filesize
116KB

Download