c4d74e49c44c880ec1b4cdede24423872f931e617b33d6bdba31e0534a12b809

Resubmissions

09/11/2024, 22:49

241109-2r2veatfrl 10

09/11/2024, 22:47

09/11/2024, 22:46

09/11/2024, 22:44

07/11/2024, 16:00

10/02/2024, 17:17

Analysis

max time kernel
121s
max time network
123s
platform
windows7_x64
resource
win7-20231129-en
resource tags

arch:x64arch:x86image:win7-20231129-enlocale:en-usos:windows7-x64system
submitted
10/02/2024, 17:17

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

ggpermV3/woof.bat
Size

1KB
MD5

9dfe4e730dcc5e0d3951038ad2a095a1
SHA1

e033d9a40234b9544606ec4d603add264cb38841
SHA256

bfffd2faf6710e02912de0eec63b593f35a8bebef114932b4a4bc9c67fad59b8
SHA512

297e9950fd207687af957a94c5fb7d073bb89dcebdd6ee047fa0465f55bb95b42563c7310980bf1e41ca671a1f8c824e86dfe515b844f99f307965d199d8dbfd

Score

8^/10

evasion

Malware Config

Signatures

Stops running service(s) 3 TTPs
evasion

Windows Service
T1543.003

Impair Defenses
T1562

Service Stop
T1489

Launches sc.exe 2 IoCs

Sc.exe is a Windows utlilty to control services on the system.

pid	Process
2984	sc.exe
2172	sc.exe

Gathers network information 2 TTPs 1 IoCs

Uses commandline utility to view network configuration.

System Information Discovery

T1082

Command and Scripting Interpreter

T1059

pid	Process
1108	ipconfig.exe

Runs net.exe

Suspicious behavior: LoadsDriver 26 IoCs

pid	Process
484	Process not Found
484	Process not Found
484	Process not Found
484	Process not Found
484	Process not Found
484	Process not Found
484	Process not Found
484	Process not Found
484	Process not Found
484	Process not Found
484	Process not Found
484	Process not Found
484	Process not Found
484	Process not Found
484	Process not Found
484	Process not Found
484	Process not Found
484	Process not Found
484	Process not Found
484	Process not Found
484	Process not Found
484	Process not Found
484	Process not Found
484	Process not Found
484	Process not Found
484	Process not Found

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2940 wrote to memory of 1996	2940	cmd.exe	29
PID 2940 wrote to memory of 1996	2940	cmd.exe	29
PID 2940 wrote to memory of 1996	2940	cmd.exe	29
PID 2940 wrote to memory of 1892	2940	cmd.exe	30
PID 2940 wrote to memory of 1892	2940	cmd.exe	30
PID 2940 wrote to memory of 1892	2940	cmd.exe	30
PID 2940 wrote to memory of 3044	2940	cmd.exe	31
PID 2940 wrote to memory of 3044	2940	cmd.exe	31
PID 2940 wrote to memory of 3044	2940	cmd.exe	31
PID 2940 wrote to memory of 3056	2940	cmd.exe	32
PID 2940 wrote to memory of 3056	2940	cmd.exe	32
PID 2940 wrote to memory of 3056	2940	cmd.exe	32
PID 2940 wrote to memory of 2524	2940	cmd.exe	33
PID 2940 wrote to memory of 2524	2940	cmd.exe	33
PID 2940 wrote to memory of 2524	2940	cmd.exe	33
PID 2940 wrote to memory of 1096	2940	cmd.exe	34
PID 2940 wrote to memory of 1096	2940	cmd.exe	34
PID 2940 wrote to memory of 1096	2940	cmd.exe	34
PID 2940 wrote to memory of 2140	2940	cmd.exe	35
PID 2940 wrote to memory of 2140	2940	cmd.exe	35
PID 2940 wrote to memory of 2140	2940	cmd.exe	35
PID 2940 wrote to memory of 2284	2940	cmd.exe	36
PID 2940 wrote to memory of 2284	2940	cmd.exe	36
PID 2940 wrote to memory of 2284	2940	cmd.exe	36
PID 2940 wrote to memory of 2280	2940	cmd.exe	37
PID 2940 wrote to memory of 2280	2940	cmd.exe	37
PID 2940 wrote to memory of 2280	2940	cmd.exe	37
PID 2940 wrote to memory of 1812	2940	cmd.exe	38
PID 2940 wrote to memory of 1812	2940	cmd.exe	38
PID 2940 wrote to memory of 1812	2940	cmd.exe	38
PID 2940 wrote to memory of 2532	2940	cmd.exe	39
PID 2940 wrote to memory of 2532	2940	cmd.exe	39
PID 2940 wrote to memory of 2532	2940	cmd.exe	39
PID 2940 wrote to memory of 2276	2940	cmd.exe	40
PID 2940 wrote to memory of 2276	2940	cmd.exe	40
PID 2940 wrote to memory of 2276	2940	cmd.exe	40
PID 2940 wrote to memory of 2584	2940	cmd.exe	41
PID 2940 wrote to memory of 2584	2940	cmd.exe	41
PID 2940 wrote to memory of 2584	2940	cmd.exe	41
PID 2940 wrote to memory of 2640	2940	cmd.exe	42
PID 2940 wrote to memory of 2640	2940	cmd.exe	42
PID 2940 wrote to memory of 2640	2940	cmd.exe	42
PID 2940 wrote to memory of 2652	2940	cmd.exe	43
PID 2940 wrote to memory of 2652	2940	cmd.exe	43
PID 2940 wrote to memory of 2652	2940	cmd.exe	43
PID 2940 wrote to memory of 2668	2940	cmd.exe	44
PID 2940 wrote to memory of 2668	2940	cmd.exe	44
PID 2940 wrote to memory of 2668	2940	cmd.exe	44
PID 2940 wrote to memory of 2636	2940	cmd.exe	45
PID 2940 wrote to memory of 2636	2940	cmd.exe	45
PID 2940 wrote to memory of 2636	2940	cmd.exe	45
PID 2940 wrote to memory of 2588	2940	cmd.exe	46
PID 2940 wrote to memory of 2588	2940	cmd.exe	46
PID 2940 wrote to memory of 2588	2940	cmd.exe	46
PID 2940 wrote to memory of 2884	2940	cmd.exe	47
PID 2940 wrote to memory of 2884	2940	cmd.exe	47
PID 2940 wrote to memory of 2884	2940	cmd.exe	47
PID 2940 wrote to memory of 1320	2940	cmd.exe	48
PID 2940 wrote to memory of 1320	2940	cmd.exe	48
PID 2940 wrote to memory of 1320	2940	cmd.exe	48
PID 2940 wrote to memory of 2556	2940	cmd.exe	49
PID 2940 wrote to memory of 2556	2940	cmd.exe	49
PID 2940 wrote to memory of 2556	2940	cmd.exe	49
PID 2940 wrote to memory of 2392	2940	cmd.exe	50

C:\Windows\system32\cmd.exe
cmd /c "C:\Users\Admin\AppData\Local\Temp\ggpermV3\woof.bat"
1⤵
- Suspicious use of WriteProcessMemory
PID:2940
- C:\Users\Admin\AppData\Local\Temp\ggpermV3\AMIDEWINx64.EXE
  AMIDEWINx64.EXE /SS 26706105053079822262
  2⤵
  PID:1996
- C:\Users\Admin\AppData\Local\Temp\ggpermV3\AMIDEWINx64.EXE
  AMIDEWINx64.EXE /SS 500123132157899229
  2⤵
  PID:1892
- C:\Users\Admin\AppData\Local\Temp\ggpermV3\AMIDEWINx64.EXE
  AMIDEWINx64.EXE /BS 227613061017486673
  2⤵
  PID:3044
- C:\Users\Admin\AppData\Local\Temp\ggpermV3\AMIDEWINx64.EXE
  AMIDEWINx64.EXE /SV 15873156251225915666
  2⤵
  PID:3056
- C:\Users\Admin\AppData\Local\Temp\ggpermV3\AMIDEWINx64.EXE
  AMIDEWINx64.EXE /BV 676198071290112381
  2⤵
  PID:2524
- C:\Users\Admin\AppData\Local\Temp\ggpermV3\AMIDEWINx64.EXE
  AMIDEWINx64.EXE /CS 31048144001833610324
  2⤵
  PID:1096
- C:\Users\Admin\AppData\Local\Temp\ggpermV3\AMIDEWINx64.EXE
  AMIDEWINx64.EXE /PSN 16044254681893012940
  2⤵
  PID:2140
- C:\Users\Admin\AppData\Local\Temp\ggpermV3\AMIDEWINx64.EXE
  AMIDEWINx64.EXE /SU AUTO
  2⤵
  PID:2284
- C:\Users\Admin\AppData\Local\Temp\ggpermV3\AMIDEWINx64.EXE
  AMIDEWINx64.EXE /PAT 531026531748814261
  2⤵
  PID:2280
- C:\Users\Admin\AppData\Local\Temp\ggpermV3\AMIDEWINx64.EXE
  AMIDEWINx64.EXE /PPN 2578718231960929167
  2⤵
  PID:1812
- C:\Users\Admin\AppData\Local\Temp\ggpermV3\AMIDEWINx64.EXE
  AMIDEWINx64.EXE /IV 1141623360145434923
  2⤵
  PID:2532
- C:\Users\Admin\AppData\Local\Temp\ggpermV3\AMIDEWINx64.EXE
  AMIDEWINx64.EXE /SM 2345710402190712335
  2⤵
  PID:2276
- C:\Users\Admin\AppData\Local\Temp\ggpermV3\AMIDEWINx64.EXE
  AMIDEWINx64.EXE /SP 251844815203217135
  2⤵
  PID:2584
- C:\Users\Admin\AppData\Local\Temp\ggpermV3\AMIDEWINx64.EXE
  AMIDEWINx64.EXE /BS 31168146131591523128
  2⤵
  PID:2640
- C:\Users\Admin\AppData\Local\Temp\ggpermV3\AMIDEWINx64.EXE
  AMIDEWINx64.EXE /SF 25970162421253718814
  2⤵
  PID:2652
- C:\Users\Admin\AppData\Local\Temp\ggpermV3\AMIDEWINx64.EXE
  AMIDEWINx64.EXE /BM 1371265692275427481
  2⤵
  PID:2668
- C:\Users\Admin\AppData\Local\Temp\ggpermV3\AMIDEWINx64.EXE
  AMIDEWINx64.EXE /BP 1932832212768520155
  2⤵
  PID:2636
- C:\Users\Admin\AppData\Local\Temp\ggpermV3\AMIDEWINx64.EXE
  AMIDEWINx64.EXE /BT 9756229741125924197
  2⤵
  PID:2588
- C:\Users\Admin\AppData\Local\Temp\ggpermV3\AMIDEWINx64.EXE
  AMIDEWINx64.EXE /BLC 1460718730592023067
  2⤵
  PID:2884
- C:\Users\Admin\AppData\Local\Temp\ggpermV3\AMIDEWINx64.EXE
  AMIDEWINx64.EXE /CM 213781398961612821
  2⤵
  PID:1320
- C:\Users\Admin\AppData\Local\Temp\ggpermV3\AMIDEWINx64.EXE
  AMIDEWINx64.EXE /CT 2303332293290707480
  2⤵
  PID:2556
- C:\Users\Admin\AppData\Local\Temp\ggpermV3\AMIDEWINx64.EXE
  AMIDEWINx64.EXE /CV 22391174632916331140
  2⤵
  PID:2392
- C:\Users\Admin\AppData\Local\Temp\ggpermV3\AMIDEWINx64.EXE
  AMIDEWINx64.EXE /CA 1072953731062920046
  2⤵
  PID:2724
- C:\Users\Admin\AppData\Local\Temp\ggpermV3\AMIDEWINx64.EXE
  AMIDEWINx64.EXE /CO 19905183728686177
  2⤵
  PID:2832
- C:\Users\Admin\AppData\Local\Temp\ggpermV3\AMIDEWINx64.EXE
  AMIDEWINx64.EXE /CSK 32983634143514801
  2⤵
  PID:2840
- C:\Users\Admin\AppData\Local\Temp\ggpermV3\AMIDEWINx64.EXE
  AMIDEWINx64.EXE /SK 5308183733025232033
  2⤵
  PID:1088
- C:\Windows\system32\net.exe
  net stop winmgmt /y
  2⤵
  PID:2604
- - C:\Windows\system32\net1.exe
    C:\Windows\system32\net1 stop winmgmt /y
    3⤵
    PID:2612
- C:\Windows\system32\net.exe
  net start winmgmt /y
  2⤵
  PID:2020
- - C:\Windows\system32\net1.exe
    C:\Windows\system32\net1 start winmgmt /y
    3⤵
    PID:2800
- C:\Windows\system32\sc.exe
  sc stop winmgmt
  2⤵
  - Launches sc.exe
  PID:2984
- C:\Windows\system32\sc.exe
  sc start winmgmt
  2⤵
  - Launches sc.exe
  PID:2172
- C:\Windows\system32\ipconfig.exe
  ipconfig /flushdns
  2⤵
  - Gathers network information
  PID:1108

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Persistence

Create or Modify System Process

T1543

Windows Service

T1543.003

Privilege Escalation

Create or Modify System Process

T1543

Windows Service

T1543.003

Defense Evasion

Impair Defenses

T1562

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Service Stop

T1489

Windows 7 deprecation

Loading Replay Monitor...