570f20894dfd4b8cd95a3ea84f9b3c6f27e20e44c1f87526a007521cf879dc60

Analysis

max time kernel
51s
max time network
51s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
20/06/2024, 03:11

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
ipscthmuninst.exe
Size 566KB
Sample240620-dprdwsvhqc
SHA256 e619406f1e0a9cde0d68612477d8a4f357f2e5bb2fd192bb4f9245ed1fefd49a
MD5 5697e14cb9abfc0c0cdc4e81e7f1e917
SHA1 f3803dbdf0ec0cb8918f0639a7bb50e97ae811df
SHA512 74b8cc1b0ff4f34a81e7b93ec31ff46b6889268db4f70fe50c4204ed82f758740cff2e98fa0068f7d730508ce4e25c5e47c638db13ac4952a695bf0d4c9583a3
SSDEEP 12288:dqSeOTosGnY/5lwLKwIDjeVyzMmLDJxKvuCa:ddNGnY/5KAOV9mLFxKvL
MD5 SHA1 SHA512 SSDEEP

Score

4^/10

Malware Config

Signatures

Drops file in Program Files directory 1 IoCs

description	ioc	Process
File created	C:\Program Files (x86)\$$25.bat	ipscthmuninst.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 3956 wrote to memory of 4160	3956	ipscthmuninst.exe	82
PID 3956 wrote to memory of 4160	3956	ipscthmuninst.exe	82
PID 3956 wrote to memory of 4160	3956	ipscthmuninst.exe	82

C:\Users\Admin\AppData\Local\Temp\ipscthmuninst.exe
"C:\Users\Admin\AppData\Local\Temp\ipscthmuninst.exe"
1⤵
- Drops file in Program Files directory
- Suspicious use of WriteProcessMemory
PID:3956
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c ""C:\Program Files (x86)\$$25.bat""
  2⤵
  PID:4160

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

$$25.bat

Path C:\Program Files (x86)\$$25.bat
Size 80B
SHA256 eb389ef7c04e2c19293e946a63f1e0d4f88d6af24e921093506da15b16610e7d
MD5 7d7c7b5679e655d45b48833973a685e5
SHA1 22d12cfc21dfc897ec8d71cc4307d5d1c90aefc8
SHA512 7b6934d4e6cf9c36ab980a9b9d089cecc37cce0e60a805e278eb9a1b83b40e109305cacba03c472a92ec9c42a7cb7377f2516d177023ab2cdf994939b7d310c9
MD5 SHA1 SHA512

Submit Download

memory/3956-0-0x0000000002210000-0x0000000002211000-memory.dmp

Download

memory/3956-4-0x0000000000400000-0x0000000000493000-memory.dmp

Download

memory/3956-5-0x0000000000400000-0x0000000000493000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads