49042e86af4503a917b8408c4faab2759688065a429015a2c90430fa7371291f

Analysis

max time kernel
211s
max time network
283s
platform
windows11-21h2_x64
resource
win11-20240611-en
resource tags

arch:x64arch:x86image:win11-20240611-enlocale:en-usos:windows11-21h2-x64system
submitted
03/07/2024, 23:01

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

Dropped Malware/PO 903886563 PDF.bat
Size

3.3MB
MD5

617c9a6889d4ff7ddb750572820c92ca
SHA1

6d6eff808d2cef7d5e9e4d080732dd1af1d0df59
SHA256

3fae97aaff7c1019e9c999a6d7cc3878dbde9f457b7e89b25081c519183b282d
SHA512

d9a04b2e24a5ec6e53ce295796ea82b954ee0338209384f4aa3e963ef80cffa44d40188245e1a064ff734beb99c7b2a4e953a2beaa02d7a598c07c8988103947
SSDEEP

49152:KVVV5AimK+13kDHc1Fc0sUiXltqXZ0IdSMvnH4db2G7+:l

Score

8^/10

evasion

Malware Config

Signatures

Sets file to hidden 1 TTPs 1 IoCs

Modifies file attributes to stop it showing in Explorer etc.

evasion

Hidden Files and Directories

T1564.001

pid	Process
2776	attrib.exe

Suspicious use of WriteProcessMemory 6 IoCs

description	pid	Process	procid_target
PID 1032 wrote to memory of 2420	1032	cmd.exe	81
PID 1032 wrote to memory of 2420	1032	cmd.exe	81
PID 1032 wrote to memory of 4252	1032	cmd.exe	82
PID 1032 wrote to memory of 4252	1032	cmd.exe	82
PID 1032 wrote to memory of 2776	1032	cmd.exe	83
PID 1032 wrote to memory of 2776	1032	cmd.exe	83

Views/modifies file attributes 1 TTPs 1 IoCs

evasion

Hidden Files and Directories

T1564.001

pid	Process
2776	attrib.exe

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\Dropped Malware\PO 903886563 PDF.bat"
1⤵
- Suspicious use of WriteProcessMemory
PID:1032
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /S /D /c" echo F "
  2⤵
  PID:2420
- C:\Windows\system32\xcopy.exe
  xcopy /d /q /y /h /i C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe C:\Users\Admin\AppData\Local\Temp\Dropped Malware\PO 903886563 PDF.bat.Qjv
  2⤵
  PID:4252
- C:\Windows\system32\attrib.exe
  attrib +s +h C:\Users\Admin\AppData\Local\Temp\Dropped Malware\PO 903886563 PDF.bat.Qjv
  2⤵
  - Sets file to hidden
  - Views/modifies file attributes
  PID:2776

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Hide Artifacts

T1564

Hidden Files and Directories

T1564.001

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Windows 7 deprecation

Loading Replay Monitor...

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads