c0747c10be35b8c1072a360c7759228b17f35d2ec890154020c716d572b00fbd

Analysis

max time kernel
361s
max time network
365s
platform
windows7_x64
resource
win7-20240221-es
resource tags

arch:x64arch:x86image:win7-20240221-eslocale:es-esos:windows7-x64systemwindows
submitted
26/04/2024, 22:54

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

CITACION DEMANDA/riband.ai
Size

653KB
MD5

e299bc66495e5c7b49a74c9b10fbf57b
SHA1

afe89b3a5ee00ad81f914231c57bbb964af0b8b7
SHA256

21387648cc4294cbf149f7b3b34056e4eaf03260ad19fb9423ab87af820fa557
SHA512

574002417bf17d1884f7b009531c16467f233b9f32064bb8b229a98336c9038b8ca390d76f68051be84eb5bbd6949df0f81888aa7c3a765762c1966c1ffc8310
SSDEEP

12288:8QceuGVPyCtDjyQqjlsxNJnatgz+RFJvrllMC4pWnN9J9eAZ7EczfW6ZtW2Z:f5yOn+2s+4FJvYC4SeZ6ZtF

Score

3^/10

Malware Config

Signatures

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000_Classes\Local Settings	rundll32.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
2580	rundll32.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 1796 wrote to memory of 2580	1796	cmd.exe	30
PID 1796 wrote to memory of 2580	1796	cmd.exe	30
PID 1796 wrote to memory of 2580	1796	cmd.exe	30

C:\Windows\system32\cmd.exe
cmd /c "C:\Users\Admin\AppData\Local\Temp\CITACION DEMANDA\riband.ai"
1⤵
- Suspicious use of WriteProcessMemory
PID:1796
- C:\Windows\system32\rundll32.exe
  "C:\Windows\system32\rundll32.exe" C:\Windows\system32\shell32.dll,OpenAs_RunDLL C:\Users\Admin\AppData\Local\Temp\CITACION DEMANDA\riband.ai
  2⤵
  - Modifies registry class
  - Suspicious behavior: GetForegroundWindowSpam
  PID:2580

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Windows 7 deprecation

Loading Replay Monitor...