fd0e318b493c9405765763d7e4750e471eda25803cb69083ecb7df90b51a5d92

Analysis

max time kernel
118s
max time network
122s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
12/02/2024, 08:13

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

96b0f680a50ecca80778e5616c29f835.exe
Size

90KB
MD5

96b0f680a50ecca80778e5616c29f835
SHA1

3b7e6f9584bd371f6a8be3bac7db3d01d014ccb4
SHA256

fd0e318b493c9405765763d7e4750e471eda25803cb69083ecb7df90b51a5d92
SHA512

d2eecd3d47fa3a4926125800804adf07372f099cecf32b7338193445854e3067d5d2d9c081790b08c9de99af2e37df5793cde738336b744c60cd067edd57f928
SSDEEP

1536:21dtGmlhGdz2IacJa3u9dfOv919D2AzKUvhWRx0q0cnfRCGRlfXVAG80x5gcR4+t:21dtGmlhGh2I43ubOvXt2I4Kq0cnjRlv

Score

7^/10

Malware Config

Signatures

Deletes itself 1 IoCs

pid	Process
2120	cmd.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 3040 wrote to memory of 2120	3040	96b0f680a50ecca80778e5616c29f835.exe	28
PID 3040 wrote to memory of 2120	3040	96b0f680a50ecca80778e5616c29f835.exe	28
PID 3040 wrote to memory of 2120	3040	96b0f680a50ecca80778e5616c29f835.exe	28
PID 3040 wrote to memory of 2120	3040	96b0f680a50ecca80778e5616c29f835.exe	28

C:\Users\Admin\AppData\Local\Temp\96b0f680a50ecca80778e5616c29f835.exe
"C:\Users\Admin\AppData\Local\Temp\96b0f680a50ecca80778e5616c29f835.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:3040
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\system32\cmd.exe" /q /c "C:\Users\Admin\AppData\Local\Temp\Cnz..bat" > nul 2> nul
  2⤵
  - Deletes itself
  PID:2120

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\Cnz..bat

Filesize
210B

MD5
11ddc528670d5c75d86f9c2d77e42cba

SHA1
f3e62a4bd491fefff28d154b8f4665cecd1ce480

SHA256
6e181b825601172cfc16539b89d4aa3939aa530fe17c53cb0543347c2c1a92de

SHA512
bde9828b42fb0e6c4a82dfc6b740d43f99519634a439ce8000fa2a647de6ca1f5a455b9092133c900a9e11e3464c06e2342c715299f418f8ba25cdb274d1e37c

Download Submit
memory/3040-2-0x0000000000400000-0x000000000041C000-memory.dmp

Filesize
112KB

Download
memory/3040-1-0x00000000001C0000-0x00000000001C1000-memory.dmp

Filesize
4KB

Download
memory/3040-0-0x0000000000400000-0x000000000041C000-memory.dmp

Filesize
112KB

Download
memory/3040-3-0x0000000000400000-0x000000000041C000-memory.dmp

Filesize
112KB

Download
memory/3040-4-0x0000000000400000-0x000000000041C000-memory.dmp

Filesize
112KB

Download
memory/3040-6-0x0000000000400000-0x000000000041C000-memory.dmp

Filesize
112KB

Download