4ecf8acab8bcd2a2994e77111dcedcb9cdd2f7a7c69b9697a42ee4367a87dc97

Analysis

max time kernel
46s
max time network
56s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
13/06/2024, 02:09

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
4ecf8acab8bcd2a2994e77111dcedcb9cdd2f7a7c69b9697a42ee4367a87dc97.exe
Size 3.2MB
Sample240613-clg6davaln
SHA256 4ecf8acab8bcd2a2994e77111dcedcb9cdd2f7a7c69b9697a42ee4367a87dc97
MD5 89918d0e016f0fc7628cd7e338c01af8
SHA1 de1c6050cdd628b8281d3eb2237509a87e2f1588
SHA512 07d8b9ca54a4280a5daf8fb68f391baa35521348d4eb155decca2db180b3188e18e12f9ef3eb3a0ade7c5f79d5a310e85cfb733c050f36ddc3b3a9a58f738197
SSDEEP 49152:eVs5urLO7ffMKkU+efWBH7DSTEfdebYazsFgFVPMcZuCgayM6:yrnHeNBECgf
MD5 SHA1 SHA512 SSDEEP

Score

3^/10

Malware Config

Signatures

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Kills process with taskkill 1 IoCs

evasion

pid	Process
2792	taskkill.exe

Suspicious behavior: GetForegroundWindowSpam 2 IoCs

pid	Process
3528	4ecf8acab8bcd2a2994e77111dcedcb9cdd2f7a7c69b9697a42ee4367a87dc97.exe
3520	4ecf8acab8bcd2a2994e77111dcedcb9cdd2f7a7c69b9697a42ee4367a87dc97.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	2792	taskkill.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 3528 wrote to memory of 4072	3528	4ecf8acab8bcd2a2994e77111dcedcb9cdd2f7a7c69b9697a42ee4367a87dc97.exe	86
PID 3528 wrote to memory of 4072	3528	4ecf8acab8bcd2a2994e77111dcedcb9cdd2f7a7c69b9697a42ee4367a87dc97.exe	86
PID 3520 wrote to memory of 1744	3520	4ecf8acab8bcd2a2994e77111dcedcb9cdd2f7a7c69b9697a42ee4367a87dc97.exe	91
PID 3520 wrote to memory of 1744	3520	4ecf8acab8bcd2a2994e77111dcedcb9cdd2f7a7c69b9697a42ee4367a87dc97.exe	91

C:\Users\Admin\AppData\Local\Temp\4ecf8acab8bcd2a2994e77111dcedcb9cdd2f7a7c69b9697a42ee4367a87dc97.exe
"C:\Users\Admin\AppData\Local\Temp\4ecf8acab8bcd2a2994e77111dcedcb9cdd2f7a7c69b9697a42ee4367a87dc97.exe"
1⤵
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of WriteProcessMemory
PID:3528
- \??\c:\windows\system32\cmstp.exe
  c:\windows\system32\cmstp.exe /au C:\windows\temp\1042077927.inf
  2⤵
  PID:4072

C:\Users\Admin\AppData\Local\Temp\4ecf8acab8bcd2a2994e77111dcedcb9cdd2f7a7c69b9697a42ee4367a87dc97.exe
C:\Users\Admin\AppData\Local\Temp\4ecf8acab8bcd2a2994e77111dcedcb9cdd2f7a7c69b9697a42ee4367a87dc97.exe
1⤵
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of WriteProcessMemory
PID:3520
- \??\c:\windows\system32\cmstp.exe
  c:\windows\system32\cmstp.exe /au C:\windows\temp\1533024804.inf
  2⤵
  PID:1744

C:\Windows\system32\taskkill.exe
taskkill /IM cmstp.exe /F
1⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:2792

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

1042077927.inf

Path C:\windows\temp\1042077927.inf
Size 581B
SHA256 0e537ed346573391c38014d654da7fa04a6a18d1de5015011e18b68cdc0d100f
MD5 9233ce1c759b0e482193546bab267516
SHA1 f1735a65e10a84bbb62f559a472ceca7a4404e5e
SHA512 de0a5f29079a7bd1e28eb98a43420db6a53ab7e904275296249ad93fc2cd08f694c2c75252238d906c4192ddb40ff71a9f0cc1f53d837b2c4cc13376b1b3bf01
MD5 SHA1 SHA512

Submit Download