556a3c14de9cef8674a51e99245f73d4cefb72cc0dbf742084fefa681ec17fb7

Analysis

max time kernel
122s
max time network
127s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
10/03/2024, 11:15

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

be77c8be8d9ebcd011f2bcb7010ce565.exe
Size

316KB
MD5

be77c8be8d9ebcd011f2bcb7010ce565
SHA1

27b3477ff4a96d4e08864c1d11ae2395d399ae24
SHA256

556a3c14de9cef8674a51e99245f73d4cefb72cc0dbf742084fefa681ec17fb7
SHA512

64e5ca127978e80308505163ca3e6dade60fdfea116a689a1802df442e8375f9194dda4307101535a6784d57a7dea4a926a4b8ff2195b5c1d8c6c6d215d37c33
SSDEEP

6144:FUORK1ttbV3kSobTYZGiNdniCoh+KiE9PXs5XSkL1:FytbV3kSoXaLnToslgO

Score

7^/10

Malware Config

Signatures

Deletes itself 1 IoCs

pid	Process
2992	cmd.exe

Runs ping.exe 1 TTPs 1 IoCs

Remote System Discovery

T1018

pid	Process
2500	PING.EXE

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
1920	be77c8be8d9ebcd011f2bcb7010ce565.exe
1920	be77c8be8d9ebcd011f2bcb7010ce565.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	1920	be77c8be8d9ebcd011f2bcb7010ce565.exe

Suspicious use of WriteProcessMemory 6 IoCs

description	pid	Process	procid_target
PID 1920 wrote to memory of 2992	1920	be77c8be8d9ebcd011f2bcb7010ce565.exe	28
PID 1920 wrote to memory of 2992	1920	be77c8be8d9ebcd011f2bcb7010ce565.exe	28
PID 1920 wrote to memory of 2992	1920	be77c8be8d9ebcd011f2bcb7010ce565.exe	28
PID 2992 wrote to memory of 2500	2992	cmd.exe	30
PID 2992 wrote to memory of 2500	2992	cmd.exe	30
PID 2992 wrote to memory of 2500	2992	cmd.exe	30

C:\Users\Admin\AppData\Local\Temp\be77c8be8d9ebcd011f2bcb7010ce565.exe
"C:\Users\Admin\AppData\Local\Temp\be77c8be8d9ebcd011f2bcb7010ce565.exe"
1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1920
- C:\Windows\system32\cmd.exe
  cmd.exe /C ping 1.1.1.1 -n 1 -w 6000 > Nul & Del "C:\Users\Admin\AppData\Local\Temp\be77c8be8d9ebcd011f2bcb7010ce565.exe"
  2⤵
  - Deletes itself
  - Suspicious use of WriteProcessMemory
  PID:2992
- - C:\Windows\system32\PING.EXE
    ping 1.1.1.1 -n 1 -w 6000
    3⤵
    - Runs ping.exe
    PID:2500

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Remote System Discovery

T1018

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads