d8d1aa6e5e90b8521afc498a136bf08c93b385ccae73f62996b05aa464c80286

Analysis

max time kernel
117s
max time network
119s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
13/03/2024, 21:57

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

c6f4680d58d7ca1365a94609632d0115.exe
Size

316KB
MD5

c6f4680d58d7ca1365a94609632d0115
SHA1

b3db3b1e341221eba69d7d912c5d5e96ddf99cdf
SHA256

d8d1aa6e5e90b8521afc498a136bf08c93b385ccae73f62996b05aa464c80286
SHA512

de2461b7e4144bc64eeb4b038d2e4e873af87f766c17b58e7cf6ecfe8028ba21dc215a833555faa4b58f019088808d967a47a964755b2b7a90b5a3c62975276f
SSDEEP

6144:FUORK1ttbV3kSobTYZGiNdniCoh+KiEeYAkPq4zO:FytbV3kSoXaLnToslg1PRzO

Score

7^/10

Malware Config

Signatures

Deletes itself 1 IoCs

pid	Process
2224	cmd.exe

Runs ping.exe 1 TTPs 1 IoCs

Remote System Discovery

T1018

pid	Process
2200	PING.EXE

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
3028	c6f4680d58d7ca1365a94609632d0115.exe
3028	c6f4680d58d7ca1365a94609632d0115.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	3028	c6f4680d58d7ca1365a94609632d0115.exe

Suspicious use of WriteProcessMemory 6 IoCs

description	pid	Process	procid_target
PID 3028 wrote to memory of 2224	3028	c6f4680d58d7ca1365a94609632d0115.exe	28
PID 3028 wrote to memory of 2224	3028	c6f4680d58d7ca1365a94609632d0115.exe	28
PID 3028 wrote to memory of 2224	3028	c6f4680d58d7ca1365a94609632d0115.exe	28
PID 2224 wrote to memory of 2200	2224	cmd.exe	30
PID 2224 wrote to memory of 2200	2224	cmd.exe	30
PID 2224 wrote to memory of 2200	2224	cmd.exe	30

C:\Users\Admin\AppData\Local\Temp\c6f4680d58d7ca1365a94609632d0115.exe
"C:\Users\Admin\AppData\Local\Temp\c6f4680d58d7ca1365a94609632d0115.exe"
1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3028
- C:\Windows\system32\cmd.exe
  cmd.exe /C ping 1.1.1.1 -n 1 -w 6000 > Nul & Del "C:\Users\Admin\AppData\Local\Temp\c6f4680d58d7ca1365a94609632d0115.exe"
  2⤵
  - Deletes itself
  - Suspicious use of WriteProcessMemory
  PID:2224
- - C:\Windows\system32\PING.EXE
    ping 1.1.1.1 -n 1 -w 6000
    3⤵
    - Runs ping.exe
    PID:2200

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Remote System Discovery

T1018

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Windows 7 deprecation

Loading Replay Monitor...