Analysis

  • max time kernel
    118s
  • max time network
    125s
  • platform
    windows7_x64
  • resource
    win7-20240221-en
  • resource tags

    arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
  • submitted
    03-06-2024 10:37

General

  • Target

    ls.exe

  • Size

    3.1MB

  • MD5

    9fee5d57bbc9ad824a24680ea7e5b6ee

  • SHA1

    79a94ee440c1dd97fb91b07d9c18d3e56c2d89a1

  • SHA256

    0329e4b80be853302b4cb08a84d70b54de5cb86247e50e5cc6d4a8f568a9aa00

  • SHA512

    4cf814c24341ff2a19be8f7a53a35440fa7dac351c676c1524eae7f76832e3ca73b2c2130df22e75e62b361feb6cd40709d957adeadcc8be673e1586cc2518cf

  • SSDEEP

    49152:HFiLmDjg0HEUKlTuK6igRROMCTI93qkw6SPjVqr1oO7jFj8Jlne+htT+:kSDjTHEUKlTuKZgjsT63+60JqZZn58Jg

Score
1/10

Malware Config

Signatures

  • Suspicious use of WriteProcessMemory 4 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\ls.exe
    "C:\Users\Admin\AppData\Local\Temp\ls.exe"
    1⤵
    • Suspicious use of WriteProcessMemory
    PID:2700
    • C:\Program Files\Java\jre7\bin\javaw.exe
      "C:\Program Files\Java\jre7\bin\javaw.exe" -jar "C:\Users\Admin\AppData\Local\Temp\ls.exe"
      2⤵
        PID:2292

    Network

    MITRE ATT&CK Matrix

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    • memory/2292-3-0x00000000021A0000-0x0000000002410000-memory.dmp

      Filesize

      2.4MB

    • memory/2292-12-0x00000000000A0000-0x00000000000A1000-memory.dmp

      Filesize

      4KB

    • memory/2292-13-0x00000000021A0000-0x0000000002410000-memory.dmp

      Filesize

      2.4MB

    • memory/2700-0-0x0000000000400000-0x0000000000413000-memory.dmp

      Filesize

      76KB