803b6b3b68524e80ca1b04d3a8f9ba31d9859aadb897f9cbfaf4fd3bf6c4ba22

Analysis

max time kernel
119s
max time network
124s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
23/01/2024, 18:22

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

703f2da1daaa6abf617c931c39cba4a8.exe
Size

488KB
MD5

703f2da1daaa6abf617c931c39cba4a8
SHA1

cfa79854520c3acb950c55f1f60174f2f68eeaf6
SHA256

803b6b3b68524e80ca1b04d3a8f9ba31d9859aadb897f9cbfaf4fd3bf6c4ba22
SHA512

ea8790c17f90ffd928c18d318091d04ac066ff24564e130aa7609f8001a42b056cdfa981a2a24119bae263639357da6b9867cf6d4273a67df10a077b1b27015f
SSDEEP

12288:FytbV3kSoXaLnToslQ92Ed7235ONYhF/ZF:Eb5kSYaLTVlqwP3/H

Score

7^/10

Malware Config

Signatures

Deletes itself 1 IoCs

pid	Process
2300	cmd.exe

Runs ping.exe 1 TTPs 1 IoCs

Remote System Discovery

T1018

pid	Process
2468	PING.EXE

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
828	703f2da1daaa6abf617c931c39cba4a8.exe
828	703f2da1daaa6abf617c931c39cba4a8.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	828	703f2da1daaa6abf617c931c39cba4a8.exe

Suspicious use of WriteProcessMemory 6 IoCs

description	pid	Process	procid_target
PID 828 wrote to memory of 2300	828	703f2da1daaa6abf617c931c39cba4a8.exe	28
PID 828 wrote to memory of 2300	828	703f2da1daaa6abf617c931c39cba4a8.exe	28
PID 828 wrote to memory of 2300	828	703f2da1daaa6abf617c931c39cba4a8.exe	28
PID 2300 wrote to memory of 2468	2300	cmd.exe	30
PID 2300 wrote to memory of 2468	2300	cmd.exe	30
PID 2300 wrote to memory of 2468	2300	cmd.exe	30

C:\Users\Admin\AppData\Local\Temp\703f2da1daaa6abf617c931c39cba4a8.exe
"C:\Users\Admin\AppData\Local\Temp\703f2da1daaa6abf617c931c39cba4a8.exe"
1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:828
- C:\Windows\system32\cmd.exe
  cmd.exe /C ping 1.1.1.1 -n 1 -w 6000 > Nul & Del "C:\Users\Admin\AppData\Local\Temp\703f2da1daaa6abf617c931c39cba4a8.exe"
  2⤵
  - Deletes itself
  - Suspicious use of WriteProcessMemory
  PID:2300
- - C:\Windows\system32\PING.EXE
    ping 1.1.1.1 -n 1 -w 6000
    3⤵
    - Runs ping.exe
    PID:2468

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Remote System Discovery

T1018

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Windows 7 deprecation

Loading Replay Monitor...