0aae6792b87274b520326328ffaab5bc2de08b68a65dbbd5519d4f396a19afb7

Analysis

max time kernel
119s
max time network
120s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
07/03/2024, 16:13

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

b91d32de17280745cb48a9c9791c8994.exe
Size

316KB
MD5

b91d32de17280745cb48a9c9791c8994
SHA1

fb69fd38176f9eb43a3dbfa9a116028dbefc49c5
SHA256

0aae6792b87274b520326328ffaab5bc2de08b68a65dbbd5519d4f396a19afb7
SHA512

63d0e152c230414687e49e7f1a1f3e14cee2a126f7c6b72013420365cb1f388930e2f195653846480112ac8119075d10173767455e4f8c03f1a3c1517884b799
SSDEEP

6144:FUORK1ttbV3kSobTYZGiNdniCoh+KiE8sDX7+J18:FytbV3kSoXaLnToslfsDyJ18

Score

7^/10

Malware Config

Signatures

Deletes itself 1 IoCs

pid	Process
2032	cmd.exe

Runs ping.exe 1 TTPs 1 IoCs

Remote System Discovery

T1018

pid	Process
2008	PING.EXE

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
2276	b91d32de17280745cb48a9c9791c8994.exe
2276	b91d32de17280745cb48a9c9791c8994.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	2276	b91d32de17280745cb48a9c9791c8994.exe

Suspicious use of WriteProcessMemory 6 IoCs

description	pid	Process	procid_target
PID 2276 wrote to memory of 2032	2276	b91d32de17280745cb48a9c9791c8994.exe	28
PID 2276 wrote to memory of 2032	2276	b91d32de17280745cb48a9c9791c8994.exe	28
PID 2276 wrote to memory of 2032	2276	b91d32de17280745cb48a9c9791c8994.exe	28
PID 2032 wrote to memory of 2008	2032	cmd.exe	30
PID 2032 wrote to memory of 2008	2032	cmd.exe	30
PID 2032 wrote to memory of 2008	2032	cmd.exe	30

C:\Users\Admin\AppData\Local\Temp\b91d32de17280745cb48a9c9791c8994.exe
"C:\Users\Admin\AppData\Local\Temp\b91d32de17280745cb48a9c9791c8994.exe"
1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2276
- C:\Windows\system32\cmd.exe
  cmd.exe /C ping 1.1.1.1 -n 1 -w 6000 > Nul & Del "C:\Users\Admin\AppData\Local\Temp\b91d32de17280745cb48a9c9791c8994.exe"
  2⤵
  - Deletes itself
  - Suspicious use of WriteProcessMemory
  PID:2032
- - C:\Windows\system32\PING.EXE
    ping 1.1.1.1 -n 1 -w 6000
    3⤵
    - Runs ping.exe
    PID:2008

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Remote System Discovery

T1018

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads