Analysis
-
max time kernel
121s -
max time network
121s -
platform
windows7_x64 -
resource
win7-20240611-en -
resource tags
arch:x64arch:x86image:win7-20240611-enlocale:en-usos:windows7-x64system -
submitted
04/07/2024, 02:00
Static task
static1
Behavioral task
behavioral1
Sample
1d8f3af92ccd8d6d0a1118a4b79b4bb6.exe
Resource
win7-20240611-en
Behavioral task
behavioral2
Sample
1d8f3af92ccd8d6d0a1118a4b79b4bb6.exe
Resource
win10v2004-20240508-en
General
-
Target
1d8f3af92ccd8d6d0a1118a4b79b4bb6.exe
-
Size
600KB
-
MD5
1d8f3af92ccd8d6d0a1118a4b79b4bb6
-
SHA1
fb2407f5ab6c18141d8244ab78a3d93b086b0b3a
-
SHA256
bb1e00d04a43f4528ed73fc26a18de995fff208ed648bbfee1eedd81b4486e50
-
SHA512
d01d2fdc20b8f74b133bbb0f5b1f2b43681adab766cd447da12bc78868e0d2ca6c9f449ac8e5d3af6b24256794798b35b9211b092e9068cfc7fdde7f24bd5dae
-
SSDEEP
12288:AOnoWBoOgkUo+5WJSOTcxIEGpzK6FSkFvTAeF0CxYgdbWzNs:AO7oOH+QhL5pzvMenYE2s
Malware Config
Signatures
-
Deletes itself 1 IoCs
pid Process 2952 cmd.exe -
Executes dropped EXE 1 IoCs
pid Process 2896 bbnb1.exe -
Drops file in System32 directory 4 IoCs
description ioc Process File created C:\Windows\SysWOW64\bbnb1.exe 1d8f3af92ccd8d6d0a1118a4b79b4bb6.exe File opened for modification C:\Windows\SysWOW64\bbnb1.exe 1d8f3af92ccd8d6d0a1118a4b79b4bb6.exe File opened for modification C:\Windows\SysWOW64\ieapfltr.dat 1d8f3af92ccd8d6d0a1118a4b79b4bb6.exe File opened for modification C:\Windows\SysWOW64\bbnb1.exe bbnb1.exe -
Drops file in Windows directory 1 IoCs
description ioc Process File created C:\Windows\Delete.bat 1d8f3af92ccd8d6d0a1118a4b79b4bb6.exe -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 1912 wrote to memory of 2952 1912 1d8f3af92ccd8d6d0a1118a4b79b4bb6.exe 29 PID 1912 wrote to memory of 2952 1912 1d8f3af92ccd8d6d0a1118a4b79b4bb6.exe 29 PID 1912 wrote to memory of 2952 1912 1d8f3af92ccd8d6d0a1118a4b79b4bb6.exe 29 PID 1912 wrote to memory of 2952 1912 1d8f3af92ccd8d6d0a1118a4b79b4bb6.exe 29
Processes
-
C:\Users\Admin\AppData\Local\Temp\1d8f3af92ccd8d6d0a1118a4b79b4bb6.exe"C:\Users\Admin\AppData\Local\Temp\1d8f3af92ccd8d6d0a1118a4b79b4bb6.exe"1⤵
- Drops file in System32 directory
- Drops file in Windows directory
- Suspicious use of WriteProcessMemory
PID:1912 -
C:\Windows\SysWOW64\cmd.execmd /c C:\Windows\Delete.bat2⤵
- Deletes itself
PID:2952
-
-
C:\Windows\SysWOW64\bbnb1.exeC:\Windows\SysWOW64\bbnb1.exe1⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:2896
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
186B
MD559f23f71dc646fc096ef75830cc451d7
SHA1220272125b2e0b3f4fd14c9e0176da1d8524e880
SHA25630f499dad83e949b37b43f475afef07c9da842a870e1901860177e84e4777dfb
SHA512dd4c605ecc3919ec6b934efb38b10d0d615c2fd864f0a94e2c6da8f8c013223b490db1782c20d597cb2964fb2035a9461c984e6923bc2516e8edcf047e9ec1a3
-
Filesize
600KB
MD51d8f3af92ccd8d6d0a1118a4b79b4bb6
SHA1fb2407f5ab6c18141d8244ab78a3d93b086b0b3a
SHA256bb1e00d04a43f4528ed73fc26a18de995fff208ed648bbfee1eedd81b4486e50
SHA512d01d2fdc20b8f74b133bbb0f5b1f2b43681adab766cd447da12bc78868e0d2ca6c9f449ac8e5d3af6b24256794798b35b9211b092e9068cfc7fdde7f24bd5dae