a2ef5ce94362471c761e0f08ec4bb1710d665267106ef1767e74f5e172357955

Analysis

max time kernel
122s
max time network
125s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
10/01/2024, 03:49

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

4f7fda157bb27a575fb8296855c6c1fe.exe
Size

316KB
MD5

4f7fda157bb27a575fb8296855c6c1fe
SHA1

e5d7dccacdfa1e1516bd98c3f030f4b803f2a7c6
SHA256

a2ef5ce94362471c761e0f08ec4bb1710d665267106ef1767e74f5e172357955
SHA512

a5e376a5a2d43f473609441806c0593bba0e7bc8726dc1f4776d3d9990626f931f98488a353ec5dd0cf7c16846392ee661a7307cfe23aae1e477acda3f48333c
SSDEEP

6144:FUORK1ttbV3kSobTYZGiNdniCoh+KiEVjbzMF+i:FytbV3kSoXaLnToslojboF+i

Score

7^/10

Malware Config

Signatures

Deletes itself 1 IoCs

pid	Process
2796	cmd.exe

Runs ping.exe 1 TTPs 1 IoCs

Remote System Discovery

T1018

pid	Process
2700	PING.EXE

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
2464	4f7fda157bb27a575fb8296855c6c1fe.exe
2464	4f7fda157bb27a575fb8296855c6c1fe.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	2464	4f7fda157bb27a575fb8296855c6c1fe.exe

Suspicious use of WriteProcessMemory 6 IoCs

description	pid	Process	procid_target
PID 2464 wrote to memory of 2796	2464	4f7fda157bb27a575fb8296855c6c1fe.exe	28
PID 2464 wrote to memory of 2796	2464	4f7fda157bb27a575fb8296855c6c1fe.exe	28
PID 2464 wrote to memory of 2796	2464	4f7fda157bb27a575fb8296855c6c1fe.exe	28
PID 2796 wrote to memory of 2700	2796	cmd.exe	30
PID 2796 wrote to memory of 2700	2796	cmd.exe	30
PID 2796 wrote to memory of 2700	2796	cmd.exe	30

C:\Users\Admin\AppData\Local\Temp\4f7fda157bb27a575fb8296855c6c1fe.exe
"C:\Users\Admin\AppData\Local\Temp\4f7fda157bb27a575fb8296855c6c1fe.exe"
1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2464
- C:\Windows\system32\cmd.exe
  cmd.exe /C ping 1.1.1.1 -n 1 -w 6000 > Nul & Del "C:\Users\Admin\AppData\Local\Temp\4f7fda157bb27a575fb8296855c6c1fe.exe"
  2⤵
  - Deletes itself
  - Suspicious use of WriteProcessMemory
  PID:2796
- - C:\Windows\system32\PING.EXE
    ping 1.1.1.1 -n 1 -w 6000
    3⤵
    - Runs ping.exe
    PID:2700

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Remote System Discovery

T1018

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Windows 7 deprecation

Loading Replay Monitor...