f18128310cffdc509b4524db7ebf50f82bdf4730fa2a07ee499dbf62763bc499

Analysis

max time kernel
122s
max time network
137s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
14/01/2024, 18:21

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

5b87367020ceb04a5dfe453fff83c350.exe
Size

488KB
MD5

5b87367020ceb04a5dfe453fff83c350
SHA1

0279927bb91db8a201ffcc847be82f341b400dbe
SHA256

f18128310cffdc509b4524db7ebf50f82bdf4730fa2a07ee499dbf62763bc499
SHA512

e08b5426ef2efe65a9cab636d7de0ba3e81ed7e80e7522029fca352386a780c7f45da822b588ad28e28492914ec848d1834b0eb7cd7d6c9f7b41ebce363576d5
SSDEEP

12288:FytbV3kSoXaLnTosl0WYYc4BHXXJhKeJV5iGlYgM:Eb5kSYaLTVl0W5/BJhTg

Score

7^/10

Malware Config

Signatures

Deletes itself 1 IoCs

pid	Process
1116	cmd.exe

Runs ping.exe 1 TTPs 1 IoCs

Remote System Discovery

T1018

pid	Process
1628	PING.EXE

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
2080	5b87367020ceb04a5dfe453fff83c350.exe
2080	5b87367020ceb04a5dfe453fff83c350.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	2080	5b87367020ceb04a5dfe453fff83c350.exe

Suspicious use of WriteProcessMemory 6 IoCs

description	pid	Process	procid_target
PID 2080 wrote to memory of 1116	2080	5b87367020ceb04a5dfe453fff83c350.exe	28
PID 2080 wrote to memory of 1116	2080	5b87367020ceb04a5dfe453fff83c350.exe	28
PID 2080 wrote to memory of 1116	2080	5b87367020ceb04a5dfe453fff83c350.exe	28
PID 1116 wrote to memory of 1628	1116	cmd.exe	30
PID 1116 wrote to memory of 1628	1116	cmd.exe	30
PID 1116 wrote to memory of 1628	1116	cmd.exe	30

C:\Users\Admin\AppData\Local\Temp\5b87367020ceb04a5dfe453fff83c350.exe
"C:\Users\Admin\AppData\Local\Temp\5b87367020ceb04a5dfe453fff83c350.exe"
1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2080
- C:\Windows\system32\cmd.exe
  cmd.exe /C ping 1.1.1.1 -n 1 -w 6000 > Nul & Del "C:\Users\Admin\AppData\Local\Temp\5b87367020ceb04a5dfe453fff83c350.exe"
  2⤵
  - Deletes itself
  - Suspicious use of WriteProcessMemory
  PID:1116
- - C:\Windows\system32\PING.EXE
    ping 1.1.1.1 -n 1 -w 6000
    3⤵
    - Runs ping.exe
    PID:1628

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Remote System Discovery

T1018

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Windows 7 deprecation

Loading Replay Monitor...