Analysis
-
max time kernel
150s -
max time network
126s -
platform
windows7_x64 -
resource
win7-20231215-en -
resource tags
arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system -
submitted
27/01/2024, 13:00
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
7a5205c2818d2b45219f7dd9ec6cb68e.exe
Resource
win7-20231215-en
windows7-x64
11 signatures
150 seconds
Behavioral task
behavioral2
Sample
7a5205c2818d2b45219f7dd9ec6cb68e.exe
Resource
win10v2004-20231222-en
windows10-2004-x64
1 signatures
150 seconds
General
-
Target
7a5205c2818d2b45219f7dd9ec6cb68e.exe
-
Size
428KB
-
MD5
7a5205c2818d2b45219f7dd9ec6cb68e
-
SHA1
3cee7f9d91f225f669c68aba19e8e2eed488b6bd
-
SHA256
386e767529ca084546f2d21427024e83ee4a24abfb98acafa8b0e2aa54fa26a6
-
SHA512
fb198a33018d8c56be87c01534e89ab55f6ab301fdb73749a1f8f8e4a52681dc2c13bfa3c0647ed240611e1f07275239ced2bca0475f3ef271bd579dbc669055
-
SSDEEP
6144:0xgEBliY6avUPEtmTLIKCrCmdf5S3y53vNmsIElbT3iA+7ic8IlejXmTpzLZiyg:xEBlQ2LHPdh3vNms4A6ic8hjK9dPg
Score
7/10
Malware Config
Signatures
-
Deletes itself 1 IoCs
pid Process 2660 cmd.exe -
Executes dropped EXE 1 IoCs
pid Process 2284 psalcdpn.exe -
Loads dropped DLL 3 IoCs
pid Process 2660 cmd.exe 2660 cmd.exe 2284 psalcdpn.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Kills process with taskkill 1 IoCs
pid Process 2800 taskkill.exe -
Runs ping.exe 1 TTPs 1 IoCs
pid Process 2728 PING.EXE -
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 2284 psalcdpn.exe 2284 psalcdpn.exe 2284 psalcdpn.exe 2284 psalcdpn.exe 2284 psalcdpn.exe 2284 psalcdpn.exe 2284 psalcdpn.exe 2284 psalcdpn.exe 2284 psalcdpn.exe 2284 psalcdpn.exe 2284 psalcdpn.exe 2284 psalcdpn.exe 2284 psalcdpn.exe 2284 psalcdpn.exe 2284 psalcdpn.exe 2284 psalcdpn.exe 2284 psalcdpn.exe 2284 psalcdpn.exe 2284 psalcdpn.exe 2284 psalcdpn.exe 2284 psalcdpn.exe 2284 psalcdpn.exe 2284 psalcdpn.exe 2284 psalcdpn.exe 2284 psalcdpn.exe 2284 psalcdpn.exe 2284 psalcdpn.exe 2284 psalcdpn.exe 2284 psalcdpn.exe 2284 psalcdpn.exe 2284 psalcdpn.exe 2284 psalcdpn.exe 2284 psalcdpn.exe 2284 psalcdpn.exe 2284 psalcdpn.exe 2284 psalcdpn.exe 2284 psalcdpn.exe 2284 psalcdpn.exe 2284 psalcdpn.exe 2284 psalcdpn.exe 2284 psalcdpn.exe 2284 psalcdpn.exe 2284 psalcdpn.exe 2284 psalcdpn.exe 2284 psalcdpn.exe 2284 psalcdpn.exe 2284 psalcdpn.exe 2284 psalcdpn.exe 2284 psalcdpn.exe 2284 psalcdpn.exe 2284 psalcdpn.exe 2284 psalcdpn.exe 2284 psalcdpn.exe 2284 psalcdpn.exe 2284 psalcdpn.exe 2284 psalcdpn.exe 2284 psalcdpn.exe 2284 psalcdpn.exe 2284 psalcdpn.exe 2284 psalcdpn.exe 2284 psalcdpn.exe 2284 psalcdpn.exe 2284 psalcdpn.exe 2284 psalcdpn.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
description pid Process Token: SeDebugPrivilege 2800 taskkill.exe -
Suspicious use of FindShellTrayWindow 4 IoCs
pid Process 2284 psalcdpn.exe 2284 psalcdpn.exe 2284 psalcdpn.exe 2284 psalcdpn.exe -
Suspicious use of SendNotifyMessage 4 IoCs
pid Process 2284 psalcdpn.exe 2284 psalcdpn.exe 2284 psalcdpn.exe 2284 psalcdpn.exe -
Suspicious use of WriteProcessMemory 16 IoCs
description pid Process procid_target PID 2828 wrote to memory of 2660 2828 7a5205c2818d2b45219f7dd9ec6cb68e.exe 28 PID 2828 wrote to memory of 2660 2828 7a5205c2818d2b45219f7dd9ec6cb68e.exe 28 PID 2828 wrote to memory of 2660 2828 7a5205c2818d2b45219f7dd9ec6cb68e.exe 28 PID 2828 wrote to memory of 2660 2828 7a5205c2818d2b45219f7dd9ec6cb68e.exe 28 PID 2660 wrote to memory of 2800 2660 cmd.exe 30 PID 2660 wrote to memory of 2800 2660 cmd.exe 30 PID 2660 wrote to memory of 2800 2660 cmd.exe 30 PID 2660 wrote to memory of 2800 2660 cmd.exe 30 PID 2660 wrote to memory of 2728 2660 cmd.exe 32 PID 2660 wrote to memory of 2728 2660 cmd.exe 32 PID 2660 wrote to memory of 2728 2660 cmd.exe 32 PID 2660 wrote to memory of 2728 2660 cmd.exe 32 PID 2660 wrote to memory of 2284 2660 cmd.exe 33 PID 2660 wrote to memory of 2284 2660 cmd.exe 33 PID 2660 wrote to memory of 2284 2660 cmd.exe 33 PID 2660 wrote to memory of 2284 2660 cmd.exe 33
Processes
-
C:\Users\Admin\AppData\Local\Temp\7a5205c2818d2b45219f7dd9ec6cb68e.exe"C:\Users\Admin\AppData\Local\Temp\7a5205c2818d2b45219f7dd9ec6cb68e.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:2828 -
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c taskkill /f /pid 2828 & ping -n 3 127.1 & del /f /q "C:\Users\Admin\AppData\Local\Temp\7a5205c2818d2b45219f7dd9ec6cb68e.exe" & start C:\Users\Admin\AppData\Local\psalcdpn.exe -f2⤵
- Deletes itself
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2660 -
C:\Windows\SysWOW64\taskkill.exetaskkill /f /pid 28283⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:2800
-
-
C:\Windows\SysWOW64\PING.EXEping -n 3 127.13⤵
- Runs ping.exe
PID:2728
-
-
C:\Users\Admin\AppData\Local\psalcdpn.exeC:\Users\Admin\AppData\Local\psalcdpn.exe -f3⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:2284
-
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
428KB
MD57a5205c2818d2b45219f7dd9ec6cb68e
SHA13cee7f9d91f225f669c68aba19e8e2eed488b6bd
SHA256386e767529ca084546f2d21427024e83ee4a24abfb98acafa8b0e2aa54fa26a6
SHA512fb198a33018d8c56be87c01534e89ab55f6ab301fdb73749a1f8f8e4a52681dc2c13bfa3c0647ed240611e1f07275239ced2bca0475f3ef271bd579dbc669055