48880c052aed0c6a6d8561257c8e8b5d1cde90090c02835982337e2b74b45ccd

Analysis

max time kernel
120s
max time network
124s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
26/03/2024, 02:11

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

4e8ab40793a3438ae0d9e4b904ac3973.exe
Size

221KB
MD5

4e8ab40793a3438ae0d9e4b904ac3973
SHA1

10345f47a06c75b2599f4a08aadfebf47a0679d2
SHA256

48880c052aed0c6a6d8561257c8e8b5d1cde90090c02835982337e2b74b45ccd
SHA512

65a4d81dc6ab74d2fac8e4e8559f3380388b31eaab53882f92d08d9044db0e4dce98f2d38dfcb0f647115617aac4db749f89c37bcbbb0b190b7cadb206e8053f
SSDEEP

3072:cP95fwVjSH3MZ0YQRYrgWbNPpEe3f1C/q/CM4BoQF9nBYvQd2a:cP95Eq3MqYQugIf1CCwnua

Score

7^/10

Malware Config

Signatures

Deletes itself 1 IoCs

pid	Process
2104	cmd.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1048 wrote to memory of 2104	1048	4e8ab40793a3438ae0d9e4b904ac3973.exe	28
PID 1048 wrote to memory of 2104	1048	4e8ab40793a3438ae0d9e4b904ac3973.exe	28
PID 1048 wrote to memory of 2104	1048	4e8ab40793a3438ae0d9e4b904ac3973.exe	28
PID 1048 wrote to memory of 2104	1048	4e8ab40793a3438ae0d9e4b904ac3973.exe	28

C:\Users\Admin\AppData\Local\Temp\4e8ab40793a3438ae0d9e4b904ac3973.exe
"C:\Users\Admin\AppData\Local\Temp\4e8ab40793a3438ae0d9e4b904ac3973.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1048
- C:\Windows\SysWOW64\cmd.exe
  cmd /c C:\Users\Admin\AppData\Local\Temp\yyyy.bat
  2⤵
  - Deletes itself
  PID:2104

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\yyyy

Filesize
221KB

MD5
106e721e67b3de6ee6c1f65d820bbcec

SHA1
734c6a9856d97cef656b1e9d53de3fe875c85743

SHA256
d2076b5f9c507b09aa0045507902ce877ce82fde1ced976b663a49c0448f900c

SHA512
5692dd504369fc5f6f6b30ced37ec89843398771625d2ba560e9f4735932ae503019cfa8fd8df5384d33af330194c8d7df6ef1afae1074bb67b4230664a9339d

Download Submit
C:\Users\Admin\AppData\Local\Temp\yyyy.bat

Filesize
337B

MD5
e51d24f6b001e6342cc30e3980e385a0

SHA1
605509279afb143d6745ca22644d37957398a201

SHA256
2351618ea524a9e8ae0c1a4dd39c792ba2c8a4ecb1b3af988b3d574ed63bd610

SHA512
b0715a54d1fbe8279c75f677c26992295beba8a62f231ee3e907faddb3c551af7703879a4f14d366313bd662290abc7f147cdfbe9c739234b8961aa9a2af1131

Download Submit
memory/1048-0-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/1048-11-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download