6a3e1833f43f867e153935467c1a7c1f7f9c2c4b7b4c716a54f959989f091bf2

Resubmissions

16/03/2024, 15:20

240316-sq9desff3410

16/03/2024, 15:16

240316-sns9esdf2110

Analysis

max time kernel
141s
max time network
124s
platform
windows7_x64
resource
win7-20231129-en
resource tags

arch:x64arch:x86image:win7-20231129-enlocale:en-usos:windows7-x64system
submitted
16/03/2024, 15:16

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
Trojan/666mm psy/666mm psy.exe
Size 7KB
Sample240316-sns9esdf21
SHA256 16f61017a179c22b18ef3b9207b1fa4dc8bc242fd36c9e73192b1a20a088e506
MD5 0094d516fb8b1cd38dbc22320db9d57c
SHA1 70dec0d081c29461c1a534905fa3ca13f559eaf9
SHA512 2fe0b815f5aee8f7b1f61d69ab8ec9e981b087a05914c64af230258f85854982026303014d997414941ec0c22c85e1ea057eb0b235883156729ce977efdbd3d0
SSDEEP 96:0P67TeuaABBDSyst9pvr51V+65lssssssso:0y7TqABBW517lssssssso
MD5 SHA1 SHA512 SSDEEP

Score

1^/10

Malware Config

Signatures

Kills process with taskkill 1 IoCs

evasion

pid	Process
2904	taskkill.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
2896	cmd.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	2904	taskkill.exe

Suspicious use of WriteProcessMemory 8 IoCs

description	pid	Process	procid_target
PID 1960 wrote to memory of 2896	1960	666mm psy.exe	29
PID 1960 wrote to memory of 2896	1960	666mm psy.exe	29
PID 1960 wrote to memory of 2896	1960	666mm psy.exe	29
PID 1960 wrote to memory of 2896	1960	666mm psy.exe	29
PID 2896 wrote to memory of 2904	2896	cmd.exe	30
PID 2896 wrote to memory of 2904	2896	cmd.exe	30
PID 2896 wrote to memory of 2904	2896	cmd.exe	30
PID 2896 wrote to memory of 2904	2896	cmd.exe	30

C:\Users\Admin\AppData\Local\Temp\Trojan\666mm psy\666mm psy.exe
"C:\Users\Admin\AppData\Local\Temp\Trojan\666mm psy\666mm psy.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1960
- C:\Windows\SysWOW64\cmd.exe
  /c ""C:\Users\Admin\AppData\Local\Temp\259397120.bat" "
  2⤵
  - Suspicious behavior: GetForegroundWindowSpam
  - Suspicious use of WriteProcessMemory
  PID:2896
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /F /IM explorer.exe
    3⤵
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:2904

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

259397120.bat

Path C:\Users\Admin\AppData\Local\Temp\259397120.bat
Size 911B
SHA256 6f88a1b6fb5975e2e49b33e7c9dabb593b18b2e7254bbe41263a9acc7294c2ac
MD5 2e90ad588f5329388216c652eebd4a33
SHA1 baa4f47ee4f195d854f8db905fcbb2539556f0e0
SHA512 b793ffcfca291e52855dd92ce1f948ce8b6f6bfe0e9a878cf7c37630b621eb417fe8b720bea8f088bec98b26c6e379bb1212d8518bb6ebed8b9840e2f9f9f778
MD5 SHA1 SHA512

Submit Download

memory/1960-17-0x0000000000400000-0x0000000000407000-memory.dmp

Download

memory/2896-12-0x0000000000320000-0x0000000000321000-memory.dmp

Download

memory/2896-19-0x0000000000320000-0x0000000000321000-memory.dmp

Download

Resubmissions

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads