570f20894dfd4b8cd95a3ea84f9b3c6f27e20e44c1f87526a007521cf879dc60

Analysis

max time kernel
122s
max time network
123s
platform
windows7_x64
resource
win7-20240419-en
resource tags

arch:x64arch:x86image:win7-20240419-enlocale:en-usos:windows7-x64system
submitted
20/06/2024, 03:11

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
ipscthmuninst.exe
Size 566KB
Sample240620-dprdwsvhqc
SHA256 e619406f1e0a9cde0d68612477d8a4f357f2e5bb2fd192bb4f9245ed1fefd49a
MD5 5697e14cb9abfc0c0cdc4e81e7f1e917
SHA1 f3803dbdf0ec0cb8918f0639a7bb50e97ae811df
SHA512 74b8cc1b0ff4f34a81e7b93ec31ff46b6889268db4f70fe50c4204ed82f758740cff2e98fa0068f7d730508ce4e25c5e47c638db13ac4952a695bf0d4c9583a3
SSDEEP 12288:dqSeOTosGnY/5lwLKwIDjeVyzMmLDJxKvuCa:ddNGnY/5KAOV9mLFxKvL
MD5 SHA1 SHA512 SSDEEP

Score

4^/10

Malware Config

Signatures

Drops file in Program Files directory 1 IoCs

description	ioc	Process
File created	C:\Program Files (x86)\$$447.bat	ipscthmuninst.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 3000 wrote to memory of 800	3000	ipscthmuninst.exe	28
PID 3000 wrote to memory of 800	3000	ipscthmuninst.exe	28
PID 3000 wrote to memory of 800	3000	ipscthmuninst.exe	28
PID 3000 wrote to memory of 800	3000	ipscthmuninst.exe	28

C:\Users\Admin\AppData\Local\Temp\ipscthmuninst.exe
"C:\Users\Admin\AppData\Local\Temp\ipscthmuninst.exe"
1⤵
- Drops file in Program Files directory
- Suspicious use of WriteProcessMemory
PID:3000
- C:\Windows\SysWOW64\cmd.exe
  cmd /c ""C:\Program Files (x86)\$$447.bat""
  2⤵
  PID:800

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

$$447.bat

Path C:\Program Files (x86)\$$447.bat
Size 81B
SHA256 54c5f528613a5cc75ee4b2a009f911c3b3406655a2be336322a6ae753cd245d3
MD5 03f25bc3260ce64344bd2e7467547ce0
SHA1 f41df4dc0a4b84a91e2791cc5bd7d7160c93eead
SHA512 650e17116f21dfb4c1dce56c12e4db509d4c56970bdc7729a802d584704c010cc6e2cac372e1a34dabfd9f043c27b537f555682ef1971ea91cd498b3ccc76e93
MD5 SHA1 SHA512

Submit Download

memory/3000-0-0x0000000000240000-0x0000000000241000-memory.dmp

Download

memory/3000-9-0x0000000000400000-0x0000000000493000-memory.dmp

Download

memory/3000-10-0x0000000000400000-0x0000000000493000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads