Analysis

  • max time kernel
    147s
  • max time network
    152s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240221-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240221-enlocale:en-usos:windows10-2004-x64system
  • submitted
    23-02-2024 22:12

General

  • Target

    a0774c8dcc1568c8a64339667325521a.exe

  • Size

    33KB

  • MD5

    a0774c8dcc1568c8a64339667325521a

  • SHA1

    488dd1aab1c278c98f852fc8c08215c1128dd7e1

  • SHA256

    1e55715d6aca42c7e6cef2eee07bdd1e02832938ca74f25b62a3c6ce91c9767a

  • SHA512

    70a060cac882737410a3d16c317f0063617931f301d448633c6aaa31d98771daaa8eba0d522778daf108a8c5ed45349129c363a111dac5dcca96ecd53cd66c11

  • SSDEEP

    768:6lz/yURinnljkQHMBQig88QE2vjKpCgJ6Xp6s/wJJnV8:izj4loW/INYCgJc0JJ2

Score
3/10

Malware Config

Signatures

  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Runs net.exe
  • Suspicious use of WriteProcessMemory 15 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\a0774c8dcc1568c8a64339667325521a.exe
    "C:\Users\Admin\AppData\Local\Temp\a0774c8dcc1568c8a64339667325521a.exe"
    1⤵
    • Suspicious use of WriteProcessMemory
    PID:4440
    • C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\dt.bat
      2⤵
      • Suspicious use of WriteProcessMemory
      PID:4880
      • C:\Windows\SysWOW64\cmd.exe
        C:\Windows\system32\cmd.exe /K c:\windows\temp\r.bat
        3⤵
        • Suspicious use of WriteProcessMemory
        PID:1588
        • C:\Windows\SysWOW64\net.exe
          net stop sharedaccess
          4⤵
          • Suspicious use of WriteProcessMemory
          PID:4976
          • C:\Windows\SysWOW64\net1.exe
            C:\Windows\system32\net1 stop sharedaccess
            5⤵
              PID:2896
          • C:\Windows\SysWOW64\ftp.exe
            ftp -s:c:\windows\temp\f.txt
            4⤵
              PID:2928

      Network

      MITRE ATT&CK Enterprise v15

      Replay Monitor

      Loading Replay Monitor...

      Downloads

      • C:\Users\Admin\AppData\Local\Temp\dt.bat

        Filesize

        1KB

        MD5

        676afdfa824e13b72aecaf6d0d65fa6c

        SHA1

        f5e918c9fe29a9b432be38b812a6087f4a49bff2

        SHA256

        896520460c090bcacba8cf6f633abf2e4c6e01c8284737b60b1f51063246e72a

        SHA512

        4ac34dd1eb77862206dc608c9b57e2956857407b7c5eced45c20b6577e2d53755254fd38300a2b7d02624c37a652ade86add230cd33c452bec380688f414f633

      • \??\c:\windows\temp\f.txt

        Filesize

        76B

        MD5

        e492c90155bb26e6c57c202780f35093

        SHA1

        83d3d0a8af4fbcd3b70a22611578ef5b5966fcb9

        SHA256

        ff07e608a348217c1306a1ff202f9b91fddf104b9367c4ee911bccefe04edb94

        SHA512

        b3265b4f58966441813a0da9032d68e061dcbe6213f82b10f83addafe93627d66637105b443534fac8e074340ff50e07e14437309ad88befc774d2daf5286259

      • \??\c:\windows\temp\r.bat

        Filesize

        164B

        MD5

        f22ad73544c4463a4fe267ed2c646a20

        SHA1

        9faba5662a5f43fad4df2182fb3c45199cd316c8

        SHA256

        188e171e17dad12fa1b8067a8b86bc113c0f9df9d9ef03e89006f9c3f7c51c98

        SHA512

        2c52ceee850adbb90863452815d60596931c485c921ef1a7c3ed8d0de028cbbfc561d62e25beb63410e867da63ebfef6c7cf0f2d1cb75fe13e566731f4df2abd