58699ab5d4d95d6755f4582bf6f7bbd8e1ef2b91f64e9845b2646e1350649f0d

Analysis

max time kernel
117s
max time network
118s
platform
windows7_x64
resource
win7-20240508-en
resource tags

arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system
submitted
26/05/2024, 10:38

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
$_3_.exe
Size 1.8MB
Sample240526-mpdbpsfc6z
SHA256 f2126481c02d2a5af29e56023902a0897d05867c1caaf8079cf6e1f05dd9b209
MD5 9ab5db4bb5971035b4d287d64f9676b5
SHA1 33d17f016339572dd05c124d6243fffefd0cd039
SHA512 d36262fdd4d8bd083d8537f0698c423240c9e42b2dc0048e2470d87411f295d6e3428587b76b0486875495d502f1f31f9edf3eb6fdb914f13421b7f29fa5f066
SSDEEP 49152:G0BIrT/YNRoLlps7tZokvTopSdmX4Foni7iMmdc:GbTRps7Xj
MD5 SHA1 SHA512 SSDEEP

Score

3^/10

Malware Config

Signatures

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Runs ping.exe 1 TTPs 1 IoCs

Remote System Discovery

T1018

pid	Process
2296	PING.EXE

Suspicious behavior: EnumeratesProcesses 1 IoCs

pid	Process
1708	$_3_.exe

Suspicious use of SetWindowsHookEx 3 IoCs

pid	Process
1708	$_3_.exe
1708	$_3_.exe
1708	$_3_.exe

Suspicious use of WriteProcessMemory 8 IoCs

description	pid	Process	procid_target
PID 1708 wrote to memory of 1964	1708	$_3_.exe	30
PID 1708 wrote to memory of 1964	1708	$_3_.exe	30
PID 1708 wrote to memory of 1964	1708	$_3_.exe	30
PID 1708 wrote to memory of 1964	1708	$_3_.exe	30
PID 1964 wrote to memory of 2296	1964	cmd.exe	32
PID 1964 wrote to memory of 2296	1964	cmd.exe	32
PID 1964 wrote to memory of 2296	1964	cmd.exe	32
PID 1964 wrote to memory of 2296	1964	cmd.exe	32

C:\Users\Admin\AppData\Local\Temp\$_3_.exe
"C:\Users\Admin\AppData\Local\Temp\$_3_.exe"
1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1708
- C:\Windows\SysWOW64\cmd.exe
  cmd /c ""C:\Users\Admin\AppData\Local\Temp\19952.bat" "C:\Users\Admin\AppData\Local\Temp\A839D2D39B9E48AC8D8BC347574127B8\""
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1964
- - C:\Windows\SysWOW64\PING.EXE
    ping 1.1.1.1 -n 1 -w 1000
    3⤵
    - Runs ping.exe
    PID:2296

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Remote System Discovery

T1018

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

$I9U522X

Path C:\$Recycle.Bin\S-1-5-21-3691908287-3775019229-3534252667-1000\$I9U522X
Size 544B
SHA256 b633f4280ca6d0a1836082551ad72488b2b1d416b0b5f1b85db18a29773138aa
MD5 4766a84ae7c445905a4ad05f772e9e18
SHA1 2b63749bfdda1c1fe2315d706ee265ead3067644
SHA512 55b21ad0f9d2fe3422d3b0f18d55f837514b8708b2e39dc45d78753e22488e17c59d14b15dbdeebc5989c050f59b8edcb9e20da5649ef0c5389b8ac06f2aaf2b
MD5 SHA1 SHA512

Submit Download

$IAKZ0V2

Path C:\$Recycle.Bin\S-1-5-21-3691908287-3775019229-3534252667-1000\$IAKZ0V2
Size 544B
SHA256 5f12b2b8afdc92fa205da7c5bf1564e872e70091bab6169ecbc2562d212f552a
MD5 393268f89b43cf8866a8acccdc2156fe
SHA1 9c210d1e724b983b46fca877cd59ab1dd9893565
SHA512 a746999186b172eeb4d052a64970880770174f82588d150770d2f4334dc04e633b85928d83c4741e9f9a8a74d84432addf52f20d7ae0b108c91b31103a2663ba
MD5 SHA1 SHA512

Submit Download

19952.bat

Path C:\Users\Admin\AppData\Local\Temp\19952.bat
Size 212B
SHA256 cdb93994093a24991c246d8b6f7003920a510a45bfc8441521314ce22a79191d
MD5 668767f1e0c7ff2b3960447e259e9f00
SHA1 32d8abf834cce72f5e845175a0af2513b00504d8
SHA512 c07f26c8601cf91d9805004668463721ab91e14f3cc59e77e20f43d98e070ea8e742c38fe8021c4ffb1ebc02e3743ab732b66ff84bb24b59a5fdcc8634c77680
MD5 SHA1 SHA512

Submit Download

A839D2D39B9E48AC8D8BC347574127B8_LogFile.txt

Path C:\Users\Admin\AppData\Local\Temp\A839D2D39B9E48AC8D8BC347574127B8\A839D2D39B9E48AC8D8BC347574127B8_LogFile.txt
Size 9KB
SHA256 48b289adbd4adb718a66da7652ee74991c37bb595ca16c922753fbce5f8ec393
MD5 31cafb2d7eed3d9c8fef614aa252e8bd
SHA1 7f734b5bd347c04c6bc22b5621dd665942e51bad
SHA512 6ea331876fee6299aa6eeb3b0f714ad5e531070850551461ec0980016c9e3695f23cd758f31d8d24df507f493ad22b90dfdf23894cf9a5b8634a13c32441ab47
SSDEEP 192:MBe4BnBPBuB9OBrBdCBsB4BvjvyBfBBQNBcBYBHBQBa:MBzBnBPBuBoBrBIBsB4BvjKBfBBsBcBU
MD5 SHA1 SHA512 SSDEEP

Submit Download

A839D2~1.TXT

Path C:\Users\Admin\AppData\Local\Temp\A839D2D39B9E48AC8D8BC347574127B8\A839D2~1.TXT
Size 112KB
SHA256 79295b1f7920e94e700605c5c19cfafd459786f79f19c748b9b2a1c83f876db3
MD5 b8b9256342713ec633fcde092b709b59
SHA1 06f56e667e790f9723ad25f07aac3b42374ecc08
SHA512 9d22f5cd88b6d04b073eedd5419c3f2efc1678b162a475b9df6fcf69b6b600e4de18a6a6303bbad0845dc867fd9eac2c8dcad6cb7233055aca6e7188489df4ed
SSDEEP 768:MBzBnBPBuBoBrBIBsB4Bv+BfBBsBcBYBHBQBrBdBQB2B9B/3B/MB1B3BpBMBaBpA:LD35Wz
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/1708-65-0x0000000000820000-0x0000000000821000-memory.dmp

Download

memory/1708-201-0x0000000000820000-0x0000000000821000-memory.dmp

Download