Analysis
-
max time kernel
122s -
max time network
125s -
platform
windows7_x64 -
resource
win7-20231215-en -
resource tags
arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system -
submitted
10/01/2024, 03:49
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
4f7fda157bb27a575fb8296855c6c1fe.exe
Resource
win7-20231215-en
5 signatures
150 seconds
Behavioral task
behavioral2
Sample
4f7fda157bb27a575fb8296855c6c1fe.exe
Resource
win10v2004-20231215-en
4 signatures
150 seconds
General
-
Target
4f7fda157bb27a575fb8296855c6c1fe.exe
-
Size
316KB
-
MD5
4f7fda157bb27a575fb8296855c6c1fe
-
SHA1
e5d7dccacdfa1e1516bd98c3f030f4b803f2a7c6
-
SHA256
a2ef5ce94362471c761e0f08ec4bb1710d665267106ef1767e74f5e172357955
-
SHA512
a5e376a5a2d43f473609441806c0593bba0e7bc8726dc1f4776d3d9990626f931f98488a353ec5dd0cf7c16846392ee661a7307cfe23aae1e477acda3f48333c
-
SSDEEP
6144:FUORK1ttbV3kSobTYZGiNdniCoh+KiEVjbzMF+i:FytbV3kSoXaLnToslojboF+i
Score
7/10
Malware Config
Signatures
-
Deletes itself 1 IoCs
pid Process 2796 cmd.exe -
Runs ping.exe 1 TTPs 1 IoCs
pid Process 2700 PING.EXE -
Suspicious behavior: EnumeratesProcesses 2 IoCs
pid Process 2464 4f7fda157bb27a575fb8296855c6c1fe.exe 2464 4f7fda157bb27a575fb8296855c6c1fe.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
description pid Process Token: SeDebugPrivilege 2464 4f7fda157bb27a575fb8296855c6c1fe.exe -
Suspicious use of WriteProcessMemory 6 IoCs
description pid Process procid_target PID 2464 wrote to memory of 2796 2464 4f7fda157bb27a575fb8296855c6c1fe.exe 28 PID 2464 wrote to memory of 2796 2464 4f7fda157bb27a575fb8296855c6c1fe.exe 28 PID 2464 wrote to memory of 2796 2464 4f7fda157bb27a575fb8296855c6c1fe.exe 28 PID 2796 wrote to memory of 2700 2796 cmd.exe 30 PID 2796 wrote to memory of 2700 2796 cmd.exe 30 PID 2796 wrote to memory of 2700 2796 cmd.exe 30
Processes
-
C:\Users\Admin\AppData\Local\Temp\4f7fda157bb27a575fb8296855c6c1fe.exe"C:\Users\Admin\AppData\Local\Temp\4f7fda157bb27a575fb8296855c6c1fe.exe"1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2464 -
C:\Windows\system32\cmd.execmd.exe /C ping 1.1.1.1 -n 1 -w 6000 > Nul & Del "C:\Users\Admin\AppData\Local\Temp\4f7fda157bb27a575fb8296855c6c1fe.exe"2⤵
- Deletes itself
- Suspicious use of WriteProcessMemory
PID:2796 -
C:\Windows\system32\PING.EXEping 1.1.1.1 -n 1 -w 60003⤵
- Runs ping.exe
PID:2700
-
-