c7b130f5b5a0c5d2fa4d202143d40393eccd2bcf563c7496a51ee267dd50bc16

Analysis

max time kernel
134s
max time network
122s
platform
windows7_x64
resource
win7-20240611-en
resource tags

arch:x64arch:x86image:win7-20240611-enlocale:en-usos:windows7-x64system
submitted
19-06-2024 01:02

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

835e27dcd567204d905fb88c8a7d9e086349f8fd626721e5364041c15a332f73.exe
Size

855KB
MD5

93e1256e37cac4fa162ea90eeb7c72b1
SHA1

e0118027062bef44053998f74162d4e125cc2d61
SHA256

835e27dcd567204d905fb88c8a7d9e086349f8fd626721e5364041c15a332f73
SHA512

a34143ad4aa2d09ee08d458c3a22cd9b005dcb20724ea34a00e7ac5ec46d3840cf191a5bb05fad52a50833029bb941c0852b7863475c1e9b92dcc605dccb75ce
SSDEEP

12288:755MHyv+3UDgck8JvirnUdnUwNwtK+CVINPX9yKBg7vjKP:15MHGhS8J3B/moit9yKe/K

Score

7^/10

Malware Config

Signatures

Drops startup file 3 IoCs

Processes:

835e27dcd567204d905fb88c8a7d9e086349f8fd626721e5364041c15a332f73.execmd.exe

description	ioc	process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\nc8f8ruu.lnk	835e27dcd567204d905fb88c8a7d9e086349f8fd626721e5364041c15a332f73.exe
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\nfjtur874uu\nc8f8ruu.exe	cmd.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\nfjtur874uu\nc8f8ruu.exe	cmd.exe

Executes dropped EXE 1 IoCs

Processes:

nc8f8ruu.exe

pid process

1972 nc8f8ruu.exe
Loads dropped DLL 2 IoCs

Processes:

cmd.exe

pid process

2760 cmd.exe
2760 cmd.exe
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082
Runs ping.exe 1 TTPs 2 IoCs

Remote System Discovery
T1018

Processes:

PING.EXEPING.EXE

pid process

2596 PING.EXE
2176 PING.EXE

pid	process
1972	nc8f8ruu.exe

pid	process
2760	cmd.exe
2760	cmd.exe

pid	process
2596	PING.EXE
2176	PING.EXE

Suspicious behavior: EnumeratesProcesses 7 IoCs

Processes:

835e27dcd567204d905fb88c8a7d9e086349f8fd626721e5364041c15a332f73.exenheyryryy4u.exenc8f8ruu.exe

pid	process
1176	835e27dcd567204d905fb88c8a7d9e086349f8fd626721e5364041c15a332f73.exe
2756	nheyryryy4u.exe
2756	nheyryryy4u.exe
2756	nheyryryy4u.exe
2756	nheyryryy4u.exe
1972	nc8f8ruu.exe
1972	nc8f8ruu.exe

Suspicious behavior: RenamesItself 1 IoCs

Processes:

835e27dcd567204d905fb88c8a7d9e086349f8fd626721e5364041c15a332f73.exe

pid process

1176 835e27dcd567204d905fb88c8a7d9e086349f8fd626721e5364041c15a332f73.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

Processes:

835e27dcd567204d905fb88c8a7d9e086349f8fd626721e5364041c15a332f73.exenheyryryy4u.exenc8f8ruu.exe

description	pid	process
Token: SeDebugPrivilege	1176	835e27dcd567204d905fb88c8a7d9e086349f8fd626721e5364041c15a332f73.exe
Token: SeDebugPrivilege	2756	nheyryryy4u.exe
Token: SeDebugPrivilege	1972	nc8f8ruu.exe

Suspicious use of WriteProcessMemory 20 IoCs

Processes:

835e27dcd567204d905fb88c8a7d9e086349f8fd626721e5364041c15a332f73.exenheyryryy4u.execmd.exe

description	pid	process	target process
PID 1176 wrote to memory of 2756	1176	835e27dcd567204d905fb88c8a7d9e086349f8fd626721e5364041c15a332f73.exe	nheyryryy4u.exe
PID 1176 wrote to memory of 2756	1176	835e27dcd567204d905fb88c8a7d9e086349f8fd626721e5364041c15a332f73.exe	nheyryryy4u.exe
PID 1176 wrote to memory of 2756	1176	835e27dcd567204d905fb88c8a7d9e086349f8fd626721e5364041c15a332f73.exe	nheyryryy4u.exe
PID 1176 wrote to memory of 2756	1176	835e27dcd567204d905fb88c8a7d9e086349f8fd626721e5364041c15a332f73.exe	nheyryryy4u.exe
PID 2756 wrote to memory of 2760	2756	nheyryryy4u.exe	cmd.exe
PID 2756 wrote to memory of 2760	2756	nheyryryy4u.exe	cmd.exe
PID 2756 wrote to memory of 2760	2756	nheyryryy4u.exe	cmd.exe
PID 2756 wrote to memory of 2760	2756	nheyryryy4u.exe	cmd.exe
PID 2760 wrote to memory of 2596	2760	cmd.exe	PING.EXE
PID 2760 wrote to memory of 2596	2760	cmd.exe	PING.EXE
PID 2760 wrote to memory of 2596	2760	cmd.exe	PING.EXE
PID 2760 wrote to memory of 2596	2760	cmd.exe	PING.EXE
PID 2760 wrote to memory of 2176	2760	cmd.exe	PING.EXE
PID 2760 wrote to memory of 2176	2760	cmd.exe	PING.EXE
PID 2760 wrote to memory of 2176	2760	cmd.exe	PING.EXE
PID 2760 wrote to memory of 2176	2760	cmd.exe	PING.EXE
PID 2760 wrote to memory of 1972	2760	cmd.exe	nc8f8ruu.exe
PID 2760 wrote to memory of 1972	2760	cmd.exe	nc8f8ruu.exe
PID 2760 wrote to memory of 1972	2760	cmd.exe	nc8f8ruu.exe
PID 2760 wrote to memory of 1972	2760	cmd.exe	nc8f8ruu.exe

C:\Users\Admin\AppData\Local\Temp\835e27dcd567204d905fb88c8a7d9e086349f8fd626721e5364041c15a332f73.exe
"C:\Users\Admin\AppData\Local\Temp\835e27dcd567204d905fb88c8a7d9e086349f8fd626721e5364041c15a332f73.exe"
1⤵
- Drops startup file
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: RenamesItself
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1176

C:\Users\Admin\AppData\Local\Temp\nheyryryy4u.exe
"C:\Users\Admin\AppData\Local\Temp\nheyryryy4u.exe"
2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2756

C:\Windows\SysWOW64\cmd.exe
"cmd" /c ping 127.0.0.1 -n 47 > nul && copy "C:\Users\Admin\AppData\Local\Temp\nheyryryy4u.exe" "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\nfjtur874uu\nc8f8ruu.exe" && ping 127.0.0.1 -n 47 > nul && "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\nfjtur874uu\nc8f8ruu.exe"
3⤵
- Drops startup file
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2760

C:\Windows\SysWOW64\PING.EXE
ping 127.0.0.1 -n 47
4⤵
- Runs ping.exe
PID:2596

C:\Windows\SysWOW64\PING.EXE
ping 127.0.0.1 -n 47
4⤵
- Runs ping.exe
PID:2176

C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\nfjtur874uu\nc8f8ruu.exe
"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\nfjtur874uu\nc8f8ruu.exe"
4⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1972

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Remote System Discovery

T1018

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\nfjtur874uu\nc8f8ruu.exe
Filesize
855KB

MD5
93e1256e37cac4fa162ea90eeb7c72b1

SHA1
e0118027062bef44053998f74162d4e125cc2d61

SHA256
835e27dcd567204d905fb88c8a7d9e086349f8fd626721e5364041c15a332f73

SHA512
a34143ad4aa2d09ee08d458c3a22cd9b005dcb20724ea34a00e7ac5ec46d3840cf191a5bb05fad52a50833029bb941c0852b7863475c1e9b92dcc605dccb75ce

Download Submit
memory/1176-0-0x000000007475E000-0x000000007475F000-memory.dmp

Filesize
4KB

Download
memory/1176-1-0x0000000001310000-0x00000000013EC000-memory.dmp

Filesize
880KB

Download
memory/1176-2-0x0000000074750000-0x0000000074E3E000-memory.dmp

Filesize
6.9MB

Download
memory/1176-3-0x0000000000BA0000-0x0000000000BE4000-memory.dmp

Filesize
272KB

Download
memory/1176-5-0x0000000074750000-0x0000000074E3E000-memory.dmp

Filesize
6.9MB

Download
memory/1972-20-0x0000000000BB0000-0x0000000000C8C000-memory.dmp

Filesize
880KB

Download
memory/2756-6-0x0000000074750000-0x0000000074E3E000-memory.dmp

Filesize
6.9MB

Download
memory/2756-7-0x0000000074750000-0x0000000074E3E000-memory.dmp

Filesize
6.9MB

Download
memory/2756-8-0x0000000074750000-0x0000000074E3E000-memory.dmp

Filesize
6.9MB

Download
memory/2756-9-0x0000000074750000-0x0000000074E3E000-memory.dmp

Filesize
6.9MB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads