Analysis
-
max time kernel
149s -
max time network
119s -
platform
windows7_x64 -
resource
win7-20231129-en -
resource tags
arch:x64arch:x86image:win7-20231129-enlocale:en-usos:windows7-x64system -
submitted
03-02-2024 07:54
Static task
static1
Behavioral task
behavioral1
Sample
8bcd00065051799b384cf1f7042bf138.exe
Resource
win7-20231129-en
Behavioral task
behavioral2
Sample
8bcd00065051799b384cf1f7042bf138.exe
Resource
win10v2004-20231222-en
General
-
Target
8bcd00065051799b384cf1f7042bf138.exe
-
Size
330KB
-
MD5
8bcd00065051799b384cf1f7042bf138
-
SHA1
1ba45a3aa56881c28803ce926dc2d1248d0d5089
-
SHA256
3f75a7549daebbd73c7d52e5520f83723b77a12ab1e2217853da30a8d0d12438
-
SHA512
663808c81b670badec0d5adef0569869b0f942695876353eb0bbb9e1580c19273e44fc930adfa5859b7339bbe3ea1958ada7f2a10fdfe9a1915e0dabdbf0cace
-
SSDEEP
6144:N/g/J/hQk2vz3/eE1/xBClfW20owuecJEo2Nmk5tG675TUGNPwEUw+Vvr41jLHeE:N/g/J/hhlENvQuFoZem2NmkbG675TUG+
Malware Config
Signatures
-
Deletes itself 1 IoCs
Processes:
cmd.exepid process 1616 cmd.exe -
Executes dropped EXE 1 IoCs
Processes:
adfkf.exepid process 2592 adfkf.exe -
Loads dropped DLL 3 IoCs
Processes:
cmd.exeadfkf.exepid process 1616 cmd.exe 1616 cmd.exe 2592 adfkf.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Kills process with taskkill 1 IoCs
Processes:
taskkill.exepid process 1508 taskkill.exe -
Runs ping.exe 1 TTPs 1 IoCs
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
Processes:
adfkf.exepid process 2592 adfkf.exe 2592 adfkf.exe 2592 adfkf.exe 2592 adfkf.exe 2592 adfkf.exe 2592 adfkf.exe 2592 adfkf.exe 2592 adfkf.exe 2592 adfkf.exe 2592 adfkf.exe 2592 adfkf.exe 2592 adfkf.exe 2592 adfkf.exe 2592 adfkf.exe 2592 adfkf.exe 2592 adfkf.exe 2592 adfkf.exe 2592 adfkf.exe 2592 adfkf.exe 2592 adfkf.exe 2592 adfkf.exe 2592 adfkf.exe 2592 adfkf.exe 2592 adfkf.exe 2592 adfkf.exe 2592 adfkf.exe 2592 adfkf.exe 2592 adfkf.exe 2592 adfkf.exe 2592 adfkf.exe 2592 adfkf.exe 2592 adfkf.exe 2592 adfkf.exe 2592 adfkf.exe 2592 adfkf.exe 2592 adfkf.exe 2592 adfkf.exe 2592 adfkf.exe 2592 adfkf.exe 2592 adfkf.exe 2592 adfkf.exe 2592 adfkf.exe 2592 adfkf.exe 2592 adfkf.exe 2592 adfkf.exe 2592 adfkf.exe 2592 adfkf.exe 2592 adfkf.exe 2592 adfkf.exe 2592 adfkf.exe 2592 adfkf.exe 2592 adfkf.exe 2592 adfkf.exe 2592 adfkf.exe 2592 adfkf.exe 2592 adfkf.exe 2592 adfkf.exe 2592 adfkf.exe 2592 adfkf.exe 2592 adfkf.exe 2592 adfkf.exe 2592 adfkf.exe 2592 adfkf.exe 2592 adfkf.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes:
taskkill.exedescription pid process Token: SeDebugPrivilege 1508 taskkill.exe -
Suspicious use of FindShellTrayWindow 4 IoCs
Processes:
adfkf.exepid process 2592 adfkf.exe 2592 adfkf.exe 2592 adfkf.exe 2592 adfkf.exe -
Suspicious use of SendNotifyMessage 4 IoCs
Processes:
adfkf.exepid process 2592 adfkf.exe 2592 adfkf.exe 2592 adfkf.exe 2592 adfkf.exe -
Suspicious use of WriteProcessMemory 16 IoCs
Processes:
8bcd00065051799b384cf1f7042bf138.execmd.exedescription pid process target process PID 2028 wrote to memory of 1616 2028 8bcd00065051799b384cf1f7042bf138.exe cmd.exe PID 2028 wrote to memory of 1616 2028 8bcd00065051799b384cf1f7042bf138.exe cmd.exe PID 2028 wrote to memory of 1616 2028 8bcd00065051799b384cf1f7042bf138.exe cmd.exe PID 2028 wrote to memory of 1616 2028 8bcd00065051799b384cf1f7042bf138.exe cmd.exe PID 1616 wrote to memory of 1508 1616 cmd.exe taskkill.exe PID 1616 wrote to memory of 1508 1616 cmd.exe taskkill.exe PID 1616 wrote to memory of 1508 1616 cmd.exe taskkill.exe PID 1616 wrote to memory of 1508 1616 cmd.exe taskkill.exe PID 1616 wrote to memory of 2676 1616 cmd.exe PING.EXE PID 1616 wrote to memory of 2676 1616 cmd.exe PING.EXE PID 1616 wrote to memory of 2676 1616 cmd.exe PING.EXE PID 1616 wrote to memory of 2676 1616 cmd.exe PING.EXE PID 1616 wrote to memory of 2592 1616 cmd.exe adfkf.exe PID 1616 wrote to memory of 2592 1616 cmd.exe adfkf.exe PID 1616 wrote to memory of 2592 1616 cmd.exe adfkf.exe PID 1616 wrote to memory of 2592 1616 cmd.exe adfkf.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\8bcd00065051799b384cf1f7042bf138.exe"C:\Users\Admin\AppData\Local\Temp\8bcd00065051799b384cf1f7042bf138.exe"1⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c taskkill /f /pid 2028 & ping -n 3 127.1 & del /f /q "C:\Users\Admin\AppData\Local\Temp\8bcd00065051799b384cf1f7042bf138.exe" & start C:\Users\Admin\AppData\Local\adfkf.exe -f2⤵
- Deletes itself
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\taskkill.exetaskkill /f /pid 20283⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\PING.EXEping -n 3 127.13⤵
- Runs ping.exe
-
C:\Users\Admin\AppData\Local\adfkf.exeC:\Users\Admin\AppData\Local\adfkf.exe -f3⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
Network
MITRE ATT&CK Matrix ATT&CK v13
Replay Monitor
Loading Replay Monitor...
Downloads
-
\Users\Admin\AppData\Local\adfkf.exeFilesize
330KB
MD58bcd00065051799b384cf1f7042bf138
SHA11ba45a3aa56881c28803ce926dc2d1248d0d5089
SHA2563f75a7549daebbd73c7d52e5520f83723b77a12ab1e2217853da30a8d0d12438
SHA512663808c81b670badec0d5adef0569869b0f942695876353eb0bbb9e1580c19273e44fc930adfa5859b7339bbe3ea1958ada7f2a10fdfe9a1915e0dabdbf0cace
-
\Users\Admin\AppData\Local\adfkf.exeFilesize
55KB
MD54a2b36b38ed491d66e1e88575e814f29
SHA107faa99f0a516a4817eedf558e376a206e8ae221
SHA256f6ddc4e6ad5ea307b73e3d83fc56a01d53446d2336e90622bd3310f3707bb4f4
SHA512e0dcf5d8f0c9ee84b76d37b073604f9c3df68a993de6480511efe88e0feb2e8668bc2b6cf6fba3ba2ef9f567d3ea0269a16e342ae1554a2b724b9fad82b980aa
-
memory/2028-0-0x0000000001000000-0x00000000010A5000-memory.dmpFilesize
660KB
-
memory/2028-2-0x0000000000230000-0x0000000000231000-memory.dmpFilesize
4KB
-
memory/2028-1-0x0000000001000000-0x00000000010A5000-memory.dmpFilesize
660KB
-
memory/2028-3-0x0000000001000000-0x00000000010A5000-memory.dmpFilesize
660KB
-
memory/2028-4-0x0000000001000000-0x00000000010A5000-memory.dmpFilesize
660KB
-
memory/2028-5-0x0000000000240000-0x0000000000242000-memory.dmpFilesize
8KB
-
memory/2028-7-0x0000000001000000-0x00000000010A5000-memory.dmpFilesize
660KB
-
memory/2592-16-0x0000000000290000-0x0000000000292000-memory.dmpFilesize
8KB
-
memory/2592-14-0x0000000001000000-0x00000000010A5000-memory.dmpFilesize
660KB
-
memory/2592-15-0x0000000001000000-0x00000000010A5000-memory.dmpFilesize
660KB
-
memory/2592-17-0x0000000001000000-0x00000000010A5000-memory.dmpFilesize
660KB
-
memory/2592-19-0x0000000000230000-0x0000000000231000-memory.dmpFilesize
4KB
-
memory/2592-18-0x0000000001000000-0x00000000010A5000-memory.dmpFilesize
660KB
-
memory/2592-20-0x0000000001000000-0x00000000010A5000-memory.dmpFilesize
660KB
-
memory/2592-21-0x0000000001000000-0x00000000010A5000-memory.dmpFilesize
660KB
-
memory/2592-22-0x0000000001000000-0x00000000010A5000-memory.dmpFilesize
660KB
-
memory/2592-23-0x0000000001000000-0x00000000010A5000-memory.dmpFilesize
660KB
-
memory/2592-24-0x0000000001000000-0x00000000010A5000-memory.dmpFilesize
660KB
-
memory/2592-25-0x0000000001000000-0x00000000010A5000-memory.dmpFilesize
660KB