6cffe7a63ec7e31aee6425c2c6ea5259f16c9e817b4bafbd3a8d8283f86d84d4

Analysis

max time kernel
122s
max time network
124s
platform
windows7_x64
resource
win7-20240508-en
resource tags

arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system
submitted
04-06-2024 01:29

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

6cffe7a63ec7e31aee6425c2c6ea5259f16c9e817b4bafbd3a8d8283f86d84d4.exe
Size

1.8MB
MD5

b53f4a29e8f17c661eff669b55504b59
SHA1

d478161c439a2455370644ad9cd0bed4ed743ab5
SHA256

6cffe7a63ec7e31aee6425c2c6ea5259f16c9e817b4bafbd3a8d8283f86d84d4
SHA512

f7a0669a86a4f02a02b59954ea6826e0ecc36f1570e0eea0b9cb6ecd58e9f29edd2c107235353c513088cd299648bb0285d2aaf5b3171beafce9bfb084a1dea8
SSDEEP

12288:0J3svJVRIliHZF/ESrnE46A9jmP/uhu/yMS08CkntxYR:ysvJvuiHZFPn3fmP/UDMS08Ckn3

Score

3^/10

Malware Config

Signatures

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious use of SetWindowsHookEx 3 IoCs

Processes:

6cffe7a63ec7e31aee6425c2c6ea5259f16c9e817b4bafbd3a8d8283f86d84d4.exe

pid	process
1620	6cffe7a63ec7e31aee6425c2c6ea5259f16c9e817b4bafbd3a8d8283f86d84d4.exe
1620	6cffe7a63ec7e31aee6425c2c6ea5259f16c9e817b4bafbd3a8d8283f86d84d4.exe
1620	6cffe7a63ec7e31aee6425c2c6ea5259f16c9e817b4bafbd3a8d8283f86d84d4.exe

Suspicious use of WriteProcessMemory 4 IoCs

Processes:

6cffe7a63ec7e31aee6425c2c6ea5259f16c9e817b4bafbd3a8d8283f86d84d4.exe

description	pid	process	target process
PID 1620 wrote to memory of 2416	1620	6cffe7a63ec7e31aee6425c2c6ea5259f16c9e817b4bafbd3a8d8283f86d84d4.exe	cmd.exe
PID 1620 wrote to memory of 2416	1620	6cffe7a63ec7e31aee6425c2c6ea5259f16c9e817b4bafbd3a8d8283f86d84d4.exe	cmd.exe
PID 1620 wrote to memory of 2416	1620	6cffe7a63ec7e31aee6425c2c6ea5259f16c9e817b4bafbd3a8d8283f86d84d4.exe	cmd.exe
PID 1620 wrote to memory of 2416	1620	6cffe7a63ec7e31aee6425c2c6ea5259f16c9e817b4bafbd3a8d8283f86d84d4.exe	cmd.exe

C:\Users\Admin\AppData\Local\Temp\6cffe7a63ec7e31aee6425c2c6ea5259f16c9e817b4bafbd3a8d8283f86d84d4.exe
"C:\Users\Admin\AppData\Local\Temp\6cffe7a63ec7e31aee6425c2c6ea5259f16c9e817b4bafbd3a8d8283f86d84d4.exe"
1⤵
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1620
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c C:\Users\Admin\AppData\Local\Temp\
  2⤵
  PID:2416

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads