59a9a2c9b21eea3211e02d76c0688a1fd3a2dac18c14b24cb935d952db33eba2

Analysis

max time kernel
121s
max time network
122s
platform
windows7_x64
resource
win7-20240215-en
resource tags

arch:x64arch:x86image:win7-20240215-enlocale:en-usos:windows7-x64system
submitted
09/03/2024, 02:17

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

b9bcfcd69aacae894fe1de73ce1cfcb5.exe
Size

94KB
MD5

b9bcfcd69aacae894fe1de73ce1cfcb5
SHA1

43da576daa85e4c2cf0496c0097bcbaba1a3b8f1
SHA256

59a9a2c9b21eea3211e02d76c0688a1fd3a2dac18c14b24cb935d952db33eba2
SHA512

91ccd45e379919d07c7e1dafa6389f2910caf95da084cefc688d93ad4092582ed923922dfe259ffbaf4a43cdf3482c8ef8db1f8d9ba429ce0b250bb7e3796b3a
SSDEEP

1536:89c//cQk4w68KXJnml4KBMrlx764OMGDoFVa2FwFIy:0cMQk431mulRPEiETFIy

Score

7^/10

Malware Config

Signatures

Deletes itself 1 IoCs

pid	Process
2300	cmd.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2944 wrote to memory of 2300	2944	b9bcfcd69aacae894fe1de73ce1cfcb5.exe	28
PID 2944 wrote to memory of 2300	2944	b9bcfcd69aacae894fe1de73ce1cfcb5.exe	28
PID 2944 wrote to memory of 2300	2944	b9bcfcd69aacae894fe1de73ce1cfcb5.exe	28
PID 2944 wrote to memory of 2300	2944	b9bcfcd69aacae894fe1de73ce1cfcb5.exe	28

C:\Users\Admin\AppData\Local\Temp\b9bcfcd69aacae894fe1de73ce1cfcb5.exe
"C:\Users\Admin\AppData\Local\Temp\b9bcfcd69aacae894fe1de73ce1cfcb5.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2944
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\system32\cmd.exe" /q /c "C:\Users\Admin\AppData\Local\Temp\Wsf..bat" > nul 2> nul
  2⤵
  - Deletes itself
  PID:2300

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\Wsf..bat

Filesize
210B

MD5
cbbd216ff2a6a2e96bc9bce2ece4aa20

SHA1
7987a468b6ff1cb3dc9463294539dd7aad3850e7

SHA256
5f832c8df93df0d3469f033afce17d5a0aef50efb737cd00dfb0da104e323c31

SHA512
08ac84bf7ab0e61375434b354f13b2bb3d9fb2cff98b66743626b57e964824fcdbe427d52104b560b9bed97877dead61f4311c53aadb59e0f33eaa50ce3911dd

Download Submit
memory/2944-1-0x0000000000230000-0x0000000000231000-memory.dmp

Filesize
4KB

Download
memory/2944-0-0x0000000000400000-0x000000000041C000-memory.dmp

Filesize
112KB

Download
memory/2944-3-0x0000000000400000-0x000000000041C000-memory.dmp

Filesize
112KB

Download
memory/2944-2-0x0000000000400000-0x000000000041C000-memory.dmp

Filesize
112KB

Download
memory/2944-5-0x0000000000400000-0x000000000041C000-memory.dmp

Filesize
112KB

Download