Analysis
-
max time kernel
118s -
max time network
121s -
platform
windows7_x64 -
resource
win7-20240221-en -
resource tags
arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system -
submitted
05-03-2024 06:26
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
b403c82a7d19c8f4096fa15c4b1e3626.exe
Resource
win7-20240221-en
windows7-x64
5 signatures
150 seconds
Behavioral task
behavioral2
Sample
b403c82a7d19c8f4096fa15c4b1e3626.exe
Resource
win10v2004-20240226-en
windows10-2004-x64
4 signatures
150 seconds
General
-
Target
b403c82a7d19c8f4096fa15c4b1e3626.exe
-
Size
316KB
-
MD5
b403c82a7d19c8f4096fa15c4b1e3626
-
SHA1
2c62c1fbf60cf3106d7e7368553d4061b998afe7
-
SHA256
a0652dcc92e430612f67ecab2cc44f1ba293f9f3824c773a42f000b433146174
-
SHA512
f7ae5a34dc549dcc5a5d9af06e84e6ede8490bfd17237f1398aea1986bead79f3790221d352b9daf89933bad422d210a3114e9413e6188b2deeabe2aeeb9968c
-
SSDEEP
6144:FUORK1ttbV3kSobTYZGiNdniCoh+KiEfXiKwYuBTD0x:FytbV3kSoXaLnToslqdwYtx
Score
7/10
Malware Config
Signatures
-
Deletes itself 1 IoCs
pid Process 2148 cmd.exe -
Runs ping.exe 1 TTPs 1 IoCs
pid Process 2996 PING.EXE -
Suspicious behavior: EnumeratesProcesses 2 IoCs
pid Process 1692 b403c82a7d19c8f4096fa15c4b1e3626.exe 1692 b403c82a7d19c8f4096fa15c4b1e3626.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
description pid Process Token: SeDebugPrivilege 1692 b403c82a7d19c8f4096fa15c4b1e3626.exe -
Suspicious use of WriteProcessMemory 6 IoCs
description pid Process procid_target PID 1692 wrote to memory of 2148 1692 b403c82a7d19c8f4096fa15c4b1e3626.exe 28 PID 1692 wrote to memory of 2148 1692 b403c82a7d19c8f4096fa15c4b1e3626.exe 28 PID 1692 wrote to memory of 2148 1692 b403c82a7d19c8f4096fa15c4b1e3626.exe 28 PID 2148 wrote to memory of 2996 2148 cmd.exe 30 PID 2148 wrote to memory of 2996 2148 cmd.exe 30 PID 2148 wrote to memory of 2996 2148 cmd.exe 30
Processes
-
C:\Users\Admin\AppData\Local\Temp\b403c82a7d19c8f4096fa15c4b1e3626.exe"C:\Users\Admin\AppData\Local\Temp\b403c82a7d19c8f4096fa15c4b1e3626.exe"1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1692 -
C:\Windows\system32\cmd.execmd.exe /C ping 1.1.1.1 -n 1 -w 6000 > Nul & Del "C:\Users\Admin\AppData\Local\Temp\b403c82a7d19c8f4096fa15c4b1e3626.exe"2⤵
- Deletes itself
- Suspicious use of WriteProcessMemory
PID:2148 -
C:\Windows\system32\PING.EXEping 1.1.1.1 -n 1 -w 60003⤵
- Runs ping.exe
PID:2996
-
-