Analysis
-
max time kernel
119s -
max time network
120s -
platform
windows7_x64 -
resource
win7-20240215-en -
resource tags
arch:x64arch:x86image:win7-20240215-enlocale:en-usos:windows7-x64system -
submitted
08-03-2024 00:23
Static task
static1
Behavioral task
behavioral1
Sample
ba0ba30000c0b800b02f9cd2460cb65c.exe
Resource
win7-20240215-en
Behavioral task
behavioral2
Sample
ba0ba30000c0b800b02f9cd2460cb65c.exe
Resource
win10v2004-20240226-en
General
-
Target
ba0ba30000c0b800b02f9cd2460cb65c.exe
-
Size
33KB
-
MD5
ba0ba30000c0b800b02f9cd2460cb65c
-
SHA1
cbcdb73b16033654796c624e8791817f3f041aad
-
SHA256
58dede0f191f15a0ffa4ce083f48efd029c5e8725ec012d0a47ffffdd9e0d39f
-
SHA512
c82628063dc481d0527ace8448f5145b0ccfa65280604919224011ef74ea372fd61c64ebb858507e5695fac9a987412e7fdcf35322c4cf26c8c35cfd7a067f50
-
SSDEEP
384:UYBZe77iR+clh81jAIrqPbllaaU92KZ7lrQ8/FRlDj0SkRIu+rZr0H1dy4SDRbt1:PBZe7e4Zmlla2KZJrQC4iuEqyNRpLeR
Malware Config
Signatures
-
Deletes itself 1 IoCs
Processes:
cmd.exepid process 2976 cmd.exe -
Drops file in System32 directory 1 IoCs
Processes:
ba0ba30000c0b800b02f9cd2460cb65c.exedescription ioc process File created C:\Windows\SysWOW64\reset5c.dll ba0ba30000c0b800b02f9cd2460cb65c.exe -
Suspicious use of SetThreadContext 1 IoCs
Processes:
ba0ba30000c0b800b02f9cd2460cb65c.exedescription pid process target process PID 1724 set thread context of 2228 1724 ba0ba30000c0b800b02f9cd2460cb65c.exe svchost.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious behavior: EnumeratesProcesses 2 IoCs
Processes:
ba0ba30000c0b800b02f9cd2460cb65c.exepid process 1724 ba0ba30000c0b800b02f9cd2460cb65c.exe 1724 ba0ba30000c0b800b02f9cd2460cb65c.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes:
ba0ba30000c0b800b02f9cd2460cb65c.exedescription pid process Token: SeDebugPrivilege 1724 ba0ba30000c0b800b02f9cd2460cb65c.exe -
Suspicious use of UnmapMainImage 1 IoCs
Processes:
ba0ba30000c0b800b02f9cd2460cb65c.exepid process 1724 ba0ba30000c0b800b02f9cd2460cb65c.exe -
Suspicious use of WriteProcessMemory 10 IoCs
Processes:
ba0ba30000c0b800b02f9cd2460cb65c.exedescription pid process target process PID 1724 wrote to memory of 496 1724 ba0ba30000c0b800b02f9cd2460cb65c.exe lsass.exe PID 1724 wrote to memory of 2228 1724 ba0ba30000c0b800b02f9cd2460cb65c.exe svchost.exe PID 1724 wrote to memory of 2228 1724 ba0ba30000c0b800b02f9cd2460cb65c.exe svchost.exe PID 1724 wrote to memory of 2228 1724 ba0ba30000c0b800b02f9cd2460cb65c.exe svchost.exe PID 1724 wrote to memory of 2228 1724 ba0ba30000c0b800b02f9cd2460cb65c.exe svchost.exe PID 1724 wrote to memory of 2228 1724 ba0ba30000c0b800b02f9cd2460cb65c.exe svchost.exe PID 1724 wrote to memory of 2976 1724 ba0ba30000c0b800b02f9cd2460cb65c.exe cmd.exe PID 1724 wrote to memory of 2976 1724 ba0ba30000c0b800b02f9cd2460cb65c.exe cmd.exe PID 1724 wrote to memory of 2976 1724 ba0ba30000c0b800b02f9cd2460cb65c.exe cmd.exe PID 1724 wrote to memory of 2976 1724 ba0ba30000c0b800b02f9cd2460cb65c.exe cmd.exe
Processes
-
C:\Windows\system32\lsass.exeC:\Windows\system32\lsass.exe1⤵
-
C:\Users\Admin\AppData\Local\Temp\ba0ba30000c0b800b02f9cd2460cb65c.exe"C:\Users\Admin\AppData\Local\Temp\ba0ba30000c0b800b02f9cd2460cb65c.exe"1⤵
- Drops file in System32 directory
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of UnmapMainImage
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\svchost.exesvchost.exe2⤵
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\system32\cmd.exe" /c del C:\Users\Admin\AppData\Local\Temp\BA0BA3~1.EXE > nul2⤵
- Deletes itself
Network
MITRE ATT&CK Matrix ATT&CK v13
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/496-1-0x00000000008E0000-0x00000000008E1000-memory.dmpFilesize
4KB
-
memory/1724-3-0x0000000000400000-0x0000000000410000-memory.dmpFilesize
64KB
-
memory/1724-2-0x0000000000220000-0x0000000000230000-memory.dmpFilesize
64KB
-
memory/1724-5-0x0000000000400000-0x0000000000410000-memory.dmpFilesize
64KB
-
memory/2228-4-0x0000000000080000-0x0000000000081000-memory.dmpFilesize
4KB