Analysis
-
max time kernel
119s -
max time network
122s -
platform
windows7_x64 -
resource
win7-20231215-en -
resource tags
arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system -
submitted
29-01-2024 09:28
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
7f7bd62b685d4868b009f26635f92fc8.exe
Resource
win7-20231215-en
windows7-x64
5 signatures
150 seconds
Behavioral task
behavioral2
Sample
7f7bd62b685d4868b009f26635f92fc8.exe
Resource
win10v2004-20231222-en
windows10-2004-x64
4 signatures
150 seconds
General
-
Target
7f7bd62b685d4868b009f26635f92fc8.exe
-
Size
544KB
-
MD5
7f7bd62b685d4868b009f26635f92fc8
-
SHA1
718cd296185ad761c9aa0821e9d2bb70425ae052
-
SHA256
94fff49088098c6b9a69831e8893680cac62a03aaa0fcc53d128fd44863b63e6
-
SHA512
af17881663fd43013e8a005871402b2f128b89b2a14df6c5f7f9b62b441c90a1126402da2ef49fe6b8fa6f346f167034f8127f38bcc504ca6237125ccebf8fe5
-
SSDEEP
12288:FytbV3kSoXaLnTosl5ttINLdkTiolEWf/OFnsSg:Eb5kSYaLTVl/tIuE0/vSg
Score
7/10
Malware Config
Signatures
-
Deletes itself 1 IoCs
pid Process 3040 cmd.exe -
Runs ping.exe 1 TTPs 1 IoCs
pid Process 2196 PING.EXE -
Suspicious behavior: EnumeratesProcesses 2 IoCs
pid Process 2980 7f7bd62b685d4868b009f26635f92fc8.exe 2980 7f7bd62b685d4868b009f26635f92fc8.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
description pid Process Token: SeDebugPrivilege 2980 7f7bd62b685d4868b009f26635f92fc8.exe -
Suspicious use of WriteProcessMemory 6 IoCs
description pid Process procid_target PID 2980 wrote to memory of 3040 2980 7f7bd62b685d4868b009f26635f92fc8.exe 28 PID 2980 wrote to memory of 3040 2980 7f7bd62b685d4868b009f26635f92fc8.exe 28 PID 2980 wrote to memory of 3040 2980 7f7bd62b685d4868b009f26635f92fc8.exe 28 PID 3040 wrote to memory of 2196 3040 cmd.exe 30 PID 3040 wrote to memory of 2196 3040 cmd.exe 30 PID 3040 wrote to memory of 2196 3040 cmd.exe 30
Processes
-
C:\Users\Admin\AppData\Local\Temp\7f7bd62b685d4868b009f26635f92fc8.exe"C:\Users\Admin\AppData\Local\Temp\7f7bd62b685d4868b009f26635f92fc8.exe"1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2980 -
C:\Windows\system32\cmd.execmd.exe /C ping 1.1.1.1 -n 1 -w 6000 > Nul & Del "C:\Users\Admin\AppData\Local\Temp\7f7bd62b685d4868b009f26635f92fc8.exe"2⤵
- Deletes itself
- Suspicious use of WriteProcessMemory
PID:3040 -
C:\Windows\system32\PING.EXEping 1.1.1.1 -n 1 -w 60003⤵
- Runs ping.exe
PID:2196
-
-