06e15b3c09d5aa9633d2d481a41eaf5ab1758b224416c5a2945022c19a6b7d87

Analysis

max time kernel
120s
max time network
121s
platform
windows7_x64
resource
win7-20231129-en
resource tags

arch:x64arch:x86image:win7-20231129-enlocale:en-usos:windows7-x64system
submitted
03-02-2024 05:51

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

8b8f08abe95595805341be857cdf1d14.exe
Size

116KB
MD5

8b8f08abe95595805341be857cdf1d14
SHA1

eb0b36c7ba28e14cd0d5ec32f7d830d71bb61600
SHA256

06e15b3c09d5aa9633d2d481a41eaf5ab1758b224416c5a2945022c19a6b7d87
SHA512

e9f1ae7a019eb511395bc79b47f0443daed407a6ebe5ce011ee67e3bf12f5a07ab3af37969b35837b87d1ee7ff81e9b61690ee7d93cbd94fff9aa5f7303ca46f
SSDEEP

1536:e8MFN7qNlfNe+zLipk+JOmuvBGVa/TYareDRRdauTZ8yEnm+Ad4gricMst:Cb7q71LzLikOupGVgeDsuTZAo4lst

Score

7^/10

Malware Config

Signatures

Deletes itself 1 IoCs

pid	Process
1684	cmd.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2816 wrote to memory of 1684	2816	8b8f08abe95595805341be857cdf1d14.exe	28
PID 2816 wrote to memory of 1684	2816	8b8f08abe95595805341be857cdf1d14.exe	28
PID 2816 wrote to memory of 1684	2816	8b8f08abe95595805341be857cdf1d14.exe	28
PID 2816 wrote to memory of 1684	2816	8b8f08abe95595805341be857cdf1d14.exe	28

C:\Users\Admin\AppData\Local\Temp\8b8f08abe95595805341be857cdf1d14.exe
"C:\Users\Admin\AppData\Local\Temp\8b8f08abe95595805341be857cdf1d14.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2816
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\system32\cmd.exe" /q /c "C:\Users\Admin\AppData\Local\Temp\Gpf..bat" > nul 2> nul
  2⤵
  - Deletes itself
  PID:1684

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\Gpf..bat

Filesize
210B

MD5
13c21f07990f7924544038bc090902e1

SHA1
7b21a676fdbbe5d87592c48f1873cc480715d064

SHA256
d02829eb1103b7d79ab91bde29af409f6033e59dc2f80454d43d29f4bfc727b5

SHA512
0cae6b5c69002caee310e2026030498132c4f983e776583fa60a28b5770095d3ffb0b90fc5eb663e762fbc1b119ee3a6ecfc171746db9e04d7647d64379a5e4b

Download Submit
memory/2816-0-0x0000000000400000-0x0000000000420000-memory.dmp

Filesize
128KB

Download
memory/2816-1-0x0000000000190000-0x000000000019C000-memory.dmp

Filesize
48KB

Download
memory/2816-2-0x0000000000400000-0x0000000000420000-memory.dmp

Filesize
128KB

Download
memory/2816-4-0x0000000000400000-0x0000000000420000-memory.dmp

Filesize
128KB

Download