Analysis
-
max time kernel
147s -
max time network
152s -
platform
windows10-2004_x64 -
resource
win10v2004-20240221-en -
resource tags
arch:x64arch:x86image:win10v2004-20240221-enlocale:en-usos:windows10-2004-x64system -
submitted
23-02-2024 22:12
Static task
static1
Behavioral task
behavioral1
Sample
a0774c8dcc1568c8a64339667325521a.exe
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
a0774c8dcc1568c8a64339667325521a.exe
Resource
win10v2004-20240221-en
General
-
Target
a0774c8dcc1568c8a64339667325521a.exe
-
Size
33KB
-
MD5
a0774c8dcc1568c8a64339667325521a
-
SHA1
488dd1aab1c278c98f852fc8c08215c1128dd7e1
-
SHA256
1e55715d6aca42c7e6cef2eee07bdd1e02832938ca74f25b62a3c6ce91c9767a
-
SHA512
70a060cac882737410a3d16c317f0063617931f301d448633c6aaa31d98771daaa8eba0d522778daf108a8c5ed45349129c363a111dac5dcca96ecd53cd66c11
-
SSDEEP
768:6lz/yURinnljkQHMBQig88QE2vjKpCgJ6Xp6s/wJJnV8:izj4loW/INYCgJc0JJ2
Malware Config
Signatures
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Runs net.exe
-
Suspicious use of WriteProcessMemory 15 IoCs
description pid Process procid_target PID 4440 wrote to memory of 4880 4440 a0774c8dcc1568c8a64339667325521a.exe 87 PID 4440 wrote to memory of 4880 4440 a0774c8dcc1568c8a64339667325521a.exe 87 PID 4440 wrote to memory of 4880 4440 a0774c8dcc1568c8a64339667325521a.exe 87 PID 4880 wrote to memory of 1588 4880 cmd.exe 90 PID 4880 wrote to memory of 1588 4880 cmd.exe 90 PID 4880 wrote to memory of 1588 4880 cmd.exe 90 PID 1588 wrote to memory of 4976 1588 cmd.exe 92 PID 1588 wrote to memory of 4976 1588 cmd.exe 92 PID 1588 wrote to memory of 4976 1588 cmd.exe 92 PID 4976 wrote to memory of 2896 4976 net.exe 94 PID 4976 wrote to memory of 2896 4976 net.exe 94 PID 4976 wrote to memory of 2896 4976 net.exe 94 PID 1588 wrote to memory of 2928 1588 cmd.exe 95 PID 1588 wrote to memory of 2928 1588 cmd.exe 95 PID 1588 wrote to memory of 2928 1588 cmd.exe 95
Processes
-
C:\Users\Admin\AppData\Local\Temp\a0774c8dcc1568c8a64339667325521a.exe"C:\Users\Admin\AppData\Local\Temp\a0774c8dcc1568c8a64339667325521a.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:4440 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\dt.bat2⤵
- Suspicious use of WriteProcessMemory
PID:4880 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /K c:\windows\temp\r.bat3⤵
- Suspicious use of WriteProcessMemory
PID:1588 -
C:\Windows\SysWOW64\net.exenet stop sharedaccess4⤵
- Suspicious use of WriteProcessMemory
PID:4976 -
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop sharedaccess5⤵PID:2896
-
-
-
C:\Windows\SysWOW64\ftp.exeftp -s:c:\windows\temp\f.txt4⤵PID:2928
-
-
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
1KB
MD5676afdfa824e13b72aecaf6d0d65fa6c
SHA1f5e918c9fe29a9b432be38b812a6087f4a49bff2
SHA256896520460c090bcacba8cf6f633abf2e4c6e01c8284737b60b1f51063246e72a
SHA5124ac34dd1eb77862206dc608c9b57e2956857407b7c5eced45c20b6577e2d53755254fd38300a2b7d02624c37a652ade86add230cd33c452bec380688f414f633
-
Filesize
76B
MD5e492c90155bb26e6c57c202780f35093
SHA183d3d0a8af4fbcd3b70a22611578ef5b5966fcb9
SHA256ff07e608a348217c1306a1ff202f9b91fddf104b9367c4ee911bccefe04edb94
SHA512b3265b4f58966441813a0da9032d68e061dcbe6213f82b10f83addafe93627d66637105b443534fac8e074340ff50e07e14437309ad88befc774d2daf5286259
-
Filesize
164B
MD5f22ad73544c4463a4fe267ed2c646a20
SHA19faba5662a5f43fad4df2182fb3c45199cd316c8
SHA256188e171e17dad12fa1b8067a8b86bc113c0f9df9d9ef03e89006f9c3f7c51c98
SHA5122c52ceee850adbb90863452815d60596931c485c921ef1a7c3ed8d0de028cbbfc561d62e25beb63410e867da63ebfef6c7cf0f2d1cb75fe13e566731f4df2abd