Analysis
-
max time kernel
203s -
max time network
147s -
platform
windows7_x64 -
resource
win7-20240221-en -
resource tags
arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system -
submitted
07-03-2024 23:25
Static task
static1
Behavioral task
behavioral1
Sample
b9ecf50bf3a11fc3246362f1eadaf583.exe
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
b9ecf50bf3a11fc3246362f1eadaf583.exe
Resource
win10v2004-20240226-en
General
-
Target
b9ecf50bf3a11fc3246362f1eadaf583.exe
-
Size
318KB
-
MD5
b9ecf50bf3a11fc3246362f1eadaf583
-
SHA1
37a3f62ff28f5830cd99646db0a7f413df063209
-
SHA256
d5400b917851857e8c8b7b31f656dd88d725d83ad61d87cb8a4b896345938ee1
-
SHA512
6f1ab3ac2c3eeffdc9980c40c6517ea0e997bc15dce043f62971d96fc3e9f63a42dd173bd9174d3eac30836e3b40af0fd853d630fdf3abd2f2a9c93e58eba64d
-
SSDEEP
6144:0rmHZusx8Y9boWjznxNtJcm7BBtwgmZ2ARREhug0tcOA2klxH9AJjQp/B:0AZusx8Y9b5/xqmLta2ARREhugYcOeqS
Malware Config
Signatures
-
Deletes itself 1 IoCs
Processes:
cmd.exepid process 2316 cmd.exe -
Executes dropped EXE 1 IoCs
Processes:
pfyfjwgvq.exepid process 2600 pfyfjwgvq.exe -
Loads dropped DLL 3 IoCs
Processes:
cmd.exepfyfjwgvq.exepid process 2316 cmd.exe 2316 cmd.exe 2600 pfyfjwgvq.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Kills process with taskkill 1 IoCs
Processes:
taskkill.exepid process 2372 taskkill.exe -
Runs ping.exe 1 TTPs 1 IoCs
-
Suspicious behavior: EnumeratesProcesses 48 IoCs
Processes:
pfyfjwgvq.exepid process 2600 pfyfjwgvq.exe 2600 pfyfjwgvq.exe 2600 pfyfjwgvq.exe 2600 pfyfjwgvq.exe 2600 pfyfjwgvq.exe 2600 pfyfjwgvq.exe 2600 pfyfjwgvq.exe 2600 pfyfjwgvq.exe 2600 pfyfjwgvq.exe 2600 pfyfjwgvq.exe 2600 pfyfjwgvq.exe 2600 pfyfjwgvq.exe 2600 pfyfjwgvq.exe 2600 pfyfjwgvq.exe 2600 pfyfjwgvq.exe 2600 pfyfjwgvq.exe 2600 pfyfjwgvq.exe 2600 pfyfjwgvq.exe 2600 pfyfjwgvq.exe 2600 pfyfjwgvq.exe 2600 pfyfjwgvq.exe 2600 pfyfjwgvq.exe 2600 pfyfjwgvq.exe 2600 pfyfjwgvq.exe 2600 pfyfjwgvq.exe 2600 pfyfjwgvq.exe 2600 pfyfjwgvq.exe 2600 pfyfjwgvq.exe 2600 pfyfjwgvq.exe 2600 pfyfjwgvq.exe 2600 pfyfjwgvq.exe 2600 pfyfjwgvq.exe 2600 pfyfjwgvq.exe 2600 pfyfjwgvq.exe 2600 pfyfjwgvq.exe 2600 pfyfjwgvq.exe 2600 pfyfjwgvq.exe 2600 pfyfjwgvq.exe 2600 pfyfjwgvq.exe 2600 pfyfjwgvq.exe 2600 pfyfjwgvq.exe 2600 pfyfjwgvq.exe 2600 pfyfjwgvq.exe 2600 pfyfjwgvq.exe 2600 pfyfjwgvq.exe 2600 pfyfjwgvq.exe 2600 pfyfjwgvq.exe 2600 pfyfjwgvq.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes:
taskkill.exedescription pid process Token: SeDebugPrivilege 2372 taskkill.exe -
Suspicious use of FindShellTrayWindow 4 IoCs
Processes:
pfyfjwgvq.exepid process 2600 pfyfjwgvq.exe 2600 pfyfjwgvq.exe 2600 pfyfjwgvq.exe 2600 pfyfjwgvq.exe -
Suspicious use of SendNotifyMessage 4 IoCs
Processes:
pfyfjwgvq.exepid process 2600 pfyfjwgvq.exe 2600 pfyfjwgvq.exe 2600 pfyfjwgvq.exe 2600 pfyfjwgvq.exe -
Suspicious use of WriteProcessMemory 16 IoCs
Processes:
b9ecf50bf3a11fc3246362f1eadaf583.execmd.exedescription pid process target process PID 2340 wrote to memory of 2316 2340 b9ecf50bf3a11fc3246362f1eadaf583.exe cmd.exe PID 2340 wrote to memory of 2316 2340 b9ecf50bf3a11fc3246362f1eadaf583.exe cmd.exe PID 2340 wrote to memory of 2316 2340 b9ecf50bf3a11fc3246362f1eadaf583.exe cmd.exe PID 2340 wrote to memory of 2316 2340 b9ecf50bf3a11fc3246362f1eadaf583.exe cmd.exe PID 2316 wrote to memory of 2372 2316 cmd.exe taskkill.exe PID 2316 wrote to memory of 2372 2316 cmd.exe taskkill.exe PID 2316 wrote to memory of 2372 2316 cmd.exe taskkill.exe PID 2316 wrote to memory of 2372 2316 cmd.exe taskkill.exe PID 2316 wrote to memory of 1504 2316 cmd.exe PING.EXE PID 2316 wrote to memory of 1504 2316 cmd.exe PING.EXE PID 2316 wrote to memory of 1504 2316 cmd.exe PING.EXE PID 2316 wrote to memory of 1504 2316 cmd.exe PING.EXE PID 2316 wrote to memory of 2600 2316 cmd.exe pfyfjwgvq.exe PID 2316 wrote to memory of 2600 2316 cmd.exe pfyfjwgvq.exe PID 2316 wrote to memory of 2600 2316 cmd.exe pfyfjwgvq.exe PID 2316 wrote to memory of 2600 2316 cmd.exe pfyfjwgvq.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\b9ecf50bf3a11fc3246362f1eadaf583.exe"C:\Users\Admin\AppData\Local\Temp\b9ecf50bf3a11fc3246362f1eadaf583.exe"1⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c taskkill /f /pid 2340 & ping -n 3 127.1 & del /f /q "C:\Users\Admin\AppData\Local\Temp\b9ecf50bf3a11fc3246362f1eadaf583.exe" & start C:\Users\Admin\AppData\Local\PFYFJW~1.EXE -f2⤵
- Deletes itself
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\taskkill.exetaskkill /f /pid 23403⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\PING.EXEping -n 3 127.13⤵
- Runs ping.exe
-
C:\Users\Admin\AppData\Local\pfyfjwgvq.exeC:\Users\Admin\AppData\Local\PFYFJW~1.EXE -f3⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
Network
MITRE ATT&CK Matrix ATT&CK v13
Replay Monitor
Loading Replay Monitor...
Downloads
-
\Users\Admin\AppData\Local\pfyfjwgvq.exeFilesize
318KB
MD5b9ecf50bf3a11fc3246362f1eadaf583
SHA137a3f62ff28f5830cd99646db0a7f413df063209
SHA256d5400b917851857e8c8b7b31f656dd88d725d83ad61d87cb8a4b896345938ee1
SHA5126f1ab3ac2c3eeffdc9980c40c6517ea0e997bc15dce043f62971d96fc3e9f63a42dd173bd9174d3eac30836e3b40af0fd853d630fdf3abd2f2a9c93e58eba64d
-
memory/2340-0-0x0000000000220000-0x0000000000221000-memory.dmpFilesize
4KB
-
memory/2340-1-0x0000000001000000-0x00000000010A5000-memory.dmpFilesize
660KB
-
memory/2340-2-0x0000000000230000-0x0000000000232000-memory.dmpFilesize
8KB
-
memory/2340-4-0x0000000001000000-0x00000000010A5000-memory.dmpFilesize
660KB
-
memory/2600-13-0x0000000001000000-0x00000000010A5000-memory.dmpFilesize
660KB
-
memory/2600-17-0x0000000001000000-0x00000000010A5000-memory.dmpFilesize
660KB
-
memory/2600-12-0x0000000001000000-0x00000000010A5000-memory.dmpFilesize
660KB
-
memory/2600-10-0x0000000001000000-0x00000000010A5000-memory.dmpFilesize
660KB
-
memory/2600-14-0x0000000001000000-0x00000000010A5000-memory.dmpFilesize
660KB
-
memory/2600-15-0x0000000001000000-0x00000000010A5000-memory.dmpFilesize
660KB
-
memory/2600-16-0x0000000001000000-0x00000000010A5000-memory.dmpFilesize
660KB
-
memory/2600-11-0x00000000001C0000-0x00000000001C2000-memory.dmpFilesize
8KB
-
memory/2600-18-0x0000000001000000-0x00000000010A5000-memory.dmpFilesize
660KB
-
memory/2600-19-0x0000000001000000-0x00000000010A5000-memory.dmpFilesize
660KB
-
memory/2600-20-0x0000000001000000-0x00000000010A5000-memory.dmpFilesize
660KB
-
memory/2600-21-0x0000000001000000-0x00000000010A5000-memory.dmpFilesize
660KB
-
memory/2600-22-0x0000000001000000-0x00000000010A5000-memory.dmpFilesize
660KB
-
memory/2600-23-0x0000000001000000-0x00000000010A5000-memory.dmpFilesize
660KB