46f3c6b1212f1b1876766d01f9a9782f8567f01a9da9b17faa33ee3978b2537e

Analysis

max time kernel
117s
max time network
118s
platform
windows7_x64
resource
win7-20231129-en
resource tags

arch:x64arch:x86image:win7-20231129-enlocale:en-usos:windows7-x64system
submitted
12/01/2024, 16:05

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

56e6c5777f1e30af02d3b5afcc172563.exe
Size

93KB
MD5

56e6c5777f1e30af02d3b5afcc172563
SHA1

4d818bf544f6b541e79bd5c141be2638a386fed7
SHA256

46f3c6b1212f1b1876766d01f9a9782f8567f01a9da9b17faa33ee3978b2537e
SHA512

1da981912d1862eb52ac2483e2f19ff8ec867b83f37f0cfdf520bf79a9a67aa9061cd512d42a4e69451c7f79c690528e32f94f2e40454ab147a216c0e85582d2
SSDEEP

1536:RyQT05QG70AQz6CwvonnZfr0od8yQoAX2D357dGweFrBNo8DirUrlFIy:bZD0o3A2lZirztrlFIy

Score

7^/10

Malware Config

Signatures

Deletes itself 1 IoCs

pid	Process
2952	cmd.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1460 wrote to memory of 2952	1460	56e6c5777f1e30af02d3b5afcc172563.exe	28
PID 1460 wrote to memory of 2952	1460	56e6c5777f1e30af02d3b5afcc172563.exe	28
PID 1460 wrote to memory of 2952	1460	56e6c5777f1e30af02d3b5afcc172563.exe	28
PID 1460 wrote to memory of 2952	1460	56e6c5777f1e30af02d3b5afcc172563.exe	28

C:\Users\Admin\AppData\Local\Temp\56e6c5777f1e30af02d3b5afcc172563.exe
"C:\Users\Admin\AppData\Local\Temp\56e6c5777f1e30af02d3b5afcc172563.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1460
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\system32\cmd.exe" /q /c "C:\Users\Admin\AppData\Local\Temp\Uhv..bat" > nul 2> nul
  2⤵
  - Deletes itself
  PID:2952

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\Uhv..bat

Filesize
210B

MD5
cd677d3373f4d8e7fc4c846345db74d2

SHA1
b527346c03b9b13486c0080c6237b54976891854

SHA256
e74fd67d275373bb646ff235e2faae727eb2997151ca7ce02e3997dd3fe0d6fe

SHA512
c43eb8ae97941e132beef2fae32aea3a65b372a279ed521de98d5161ef586d196f0f92d54a08f4f1e0c2f15836e24ca1222932f056dda3358b2a45cde533b27d

Download Submit
memory/1460-1-0x0000000000230000-0x0000000000231000-memory.dmp

Filesize
4KB

Download
memory/1460-0-0x0000000000400000-0x000000000041C000-memory.dmp

Filesize
112KB

Download
memory/1460-2-0x0000000000400000-0x000000000041C000-memory.dmp

Filesize
112KB

Download
memory/1460-3-0x0000000000400000-0x000000000041C000-memory.dmp

Filesize
112KB

Download
memory/1460-5-0x0000000000400000-0x000000000041C000-memory.dmp

Filesize
112KB

Download