Analysis
-
max time kernel
3s -
max time network
4s -
platform
windows7_x64 -
resource
win7-20240221-en -
resource tags
-
submitted
16/05/2024, 15:02
General
-
Target
public.1.0.3.vmp_[unknowncheats.me]_.exe
-
Size
9.7MB
-
MD5
ce8d8052541589614527837b967ff5e0
-
SHA1
208ab48c32fe85475b7a6dc662b7de0d679f9c07
-
SHA256
d730ceacee74dbdd47960c70b4bb7edc54d782106556015eee1a98f157e0f167
-
SHA512
f8dcd7f9e27b59d7b572e583ec444f4219ec87d83d5d08b4db16ae546479c25ffe58f618a53f3621733db734f44220f66afbf3c96c2134c90be76cd1d5f545b3
-
SSDEEP
196608:xhCP63gMRwpgrMl5x6pUoyjZZfJSYPp8Ymmo8qCtPen82zPNO7:x4yQ6wpwM3oqRXcRYmmoSt2nblO7
Score
7/10
Malware Config
Signatures
-
Deletes itself 1 IoCs
-
Suspicious use of NtSetInformationThreadHideFromDebugger 2 IoCs
-
Runs ping.exe 1 TTPs 1 IoCs
-
Suspicious behavior: EnumeratesProcesses 1 IoCs
-
Suspicious use of WriteProcessMemory 6 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\public.1.0.3.vmp_[unknowncheats.me]_.exe"C:\Users\Admin\AppData\Local\Temp\public.1.0.3.vmp_[unknowncheats.me]_.exe"1⤵
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\cmd.execmd.exe /C ping 1.1.1.1 -n 1 -w 3000 > Nul & Del /f /q "C:\Users\Admin\AppData\Local\Temp\public.1.0.3.vmp_[unknowncheats.me]_.exe"2⤵
- Deletes itself
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\PING.EXEping 1.1.1.1 -n 1 -w 30003⤵
- Runs ping.exe
-
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
5.2MB
-
Filesize
8KB
-
Filesize
8KB
-
Filesize
8KB
-
Filesize
8KB
-
Filesize
8KB
-
Filesize
8KB
-
Filesize
16.1MB
-
Filesize
16.1MB
-
Filesize
5.2MB
-
Filesize
16.1MB