b40f12af5c52a4b36b16d7bc02631435074420deb06ac7c01c130ca9b8828237

Analysis

max time kernel
119s
max time network
120s
platform
windows7_x64
resource
win7-20231129-en
resource tags

arch:x64arch:x86image:win7-20231129-enlocale:en-usos:windows7-x64system
submitted
28/01/2024, 09:22

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

7cbff1a4bbc061e3feef7b6aac2cb199.exe
Size

221KB
MD5

7cbff1a4bbc061e3feef7b6aac2cb199
SHA1

2da62197957675d9b643b2f233837602a6b16913
SHA256

b40f12af5c52a4b36b16d7bc02631435074420deb06ac7c01c130ca9b8828237
SHA512

b47c57d9a62a74e80d1dccbd189b0fdb8c905047f9f2fa365d5558d4249f678fa5884921aa3d7bdf0276302897a3a2c4c461ed665a0eb24d9b7d9f56dee273ca
SSDEEP

3072:7I/mS4PL5AcHRW14UZm5TqeNm32egD5Bazp67bOhzI:7I/85/MWUQxh95Bag7b

Score

7^/10

Malware Config

Signatures

Deletes itself 1 IoCs

pid	Process
1988	cmd.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 1072 wrote to memory of 1988	1072	7cbff1a4bbc061e3feef7b6aac2cb199.exe	28
PID 1072 wrote to memory of 1988	1072	7cbff1a4bbc061e3feef7b6aac2cb199.exe	28
PID 1072 wrote to memory of 1988	1072	7cbff1a4bbc061e3feef7b6aac2cb199.exe	28
PID 1072 wrote to memory of 1988	1072	7cbff1a4bbc061e3feef7b6aac2cb199.exe	28
PID 1072 wrote to memory of 1988	1072	7cbff1a4bbc061e3feef7b6aac2cb199.exe	28
PID 1072 wrote to memory of 1988	1072	7cbff1a4bbc061e3feef7b6aac2cb199.exe	28
PID 1072 wrote to memory of 1988	1072	7cbff1a4bbc061e3feef7b6aac2cb199.exe	28

C:\Users\Admin\AppData\Local\Temp\7cbff1a4bbc061e3feef7b6aac2cb199.exe
"C:\Users\Admin\AppData\Local\Temp\7cbff1a4bbc061e3feef7b6aac2cb199.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1072
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\system32\cmd.exe" /q /c "C:\Users\Admin\AppData\Local\Temp\Lpv..bat" > nul 2> nul
  2⤵
  - Deletes itself
  PID:1988

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\Lpv..bat

Filesize
210B

MD5
3e15c48abc6403be0c76f43cd744fb9f

SHA1
4d9156e1411cd8e8a9a133a0ead07aa8bdf3bc6c

SHA256
40b933e775dcd99656b998b49f198c5cba13064e61a78ecbc84cf884ec865253

SHA512
b1a9421fe6ddfb64164786248e7750bb336322673dfb20ec6d63b118bb98b55d2d66475ff2b4ba1de89c4db93c386abcea1782c3702b390fd360b8c95f8353d6

Download Submit
memory/1072-1-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/1072-0-0x0000000000330000-0x0000000000349000-memory.dmp

Filesize
100KB

Download
memory/1072-3-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download