9c1d04ea9fe4dcaa3a1ca4113abf2d14f84add962bf12871533d687b737d6f65

Analysis

max time kernel
118s
max time network
122s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
11/01/2024, 08:15

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

5300f239319a3809994c54c286450472.exe
Size

112KB
MD5

5300f239319a3809994c54c286450472
SHA1

45d27ffe0037713bb2dcb6e4098cdabcd8aea2b4
SHA256

9c1d04ea9fe4dcaa3a1ca4113abf2d14f84add962bf12871533d687b737d6f65
SHA512

a185573764892bf6fadeb61d6cc039a00a97ec8914eb71ba4bbf2a5f2532b44c080cf62bde02d5dd7ddee04e0b73114111f91881737da53bcf41c4387461f8e0
SSDEEP

3072:waO5SQHsgYkDp54Xg0WdhybYAgdAdwPVZR3cW:wf0DZOuYABdwd

Score

7^/10

Malware Config

Signatures

Deletes itself 1 IoCs

pid	Process
2928	cmd.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2932 wrote to memory of 2928	2932	5300f239319a3809994c54c286450472.exe	28
PID 2932 wrote to memory of 2928	2932	5300f239319a3809994c54c286450472.exe	28
PID 2932 wrote to memory of 2928	2932	5300f239319a3809994c54c286450472.exe	28
PID 2932 wrote to memory of 2928	2932	5300f239319a3809994c54c286450472.exe	28

C:\Users\Admin\AppData\Local\Temp\5300f239319a3809994c54c286450472.exe
"C:\Users\Admin\AppData\Local\Temp\5300f239319a3809994c54c286450472.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2932
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\system32\cmd.exe" /q /c "C:\Users\Admin\AppData\Local\Temp\Qvf..bat" > nul 2> nul
  2⤵
  - Deletes itself
  PID:2928

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\Qvf..bat

Filesize
210B

MD5
660c565206b5288f90b8cbcc249a9920

SHA1
559b9850af2ec5e58d86f5c154ea1457cdb0491e

SHA256
5727fd4d1e35cfc63f8f3b7b81349082325ec74865f0b3ae8b79d48f9f3a044d

SHA512
b2499920354308ed5a15188bdb80bf89859382f44d321c859efcf294ebfc659b6994ab5912dce351e40186ffa7e4f738d1fde7dacd8995c12d72d7ae8924bac1

Download Submit
memory/2932-0-0x0000000000250000-0x0000000000279000-memory.dmp

Filesize
164KB

Download
memory/2932-1-0x0000000000250000-0x0000000000279000-memory.dmp

Filesize
164KB

Download
memory/2932-2-0x0000000000400000-0x000000000041F000-memory.dmp

Filesize
124KB

Download
memory/2932-4-0x0000000000400000-0x000000000041F000-memory.dmp

Filesize
124KB

Download