Overview
overview
10Static
static
3aaa.iso
windows7-x64
3aaa.iso
windows10-1703-x64
3out.iso
windows7-x64
1out.iso
windows10-1703-x64
16438/8157.cmd
windows7-x64
76438/8157.cmd
windows10-1703-x64
76438/plugged.dll
windows7-x64
106438/plugged.dll
windows10-1703-x64
10Overdue.lnk
windows7-x64
1Overdue.lnk
windows10-1703-x64
3Analysis
-
max time kernel
120s -
max time network
120s -
platform
windows7_x64 -
resource
win7-20240708-en -
resource tags
arch:x64arch:x86image:win7-20240708-enlocale:en-usos:windows7-x64system -
submitted
03-08-2024 11:14
Static task
static1
Behavioral task
behavioral1
Sample
aaa.iso
Resource
win7-20240704-en
Behavioral task
behavioral2
Sample
aaa.iso
Resource
win10-20240611-en
Behavioral task
behavioral3
Sample
out.iso
Resource
win7-20240705-en
Behavioral task
behavioral4
Sample
out.iso
Resource
win10-20240611-en
Behavioral task
behavioral5
Sample
6438/8157.cmd
Resource
win7-20240708-en
Behavioral task
behavioral6
Sample
6438/8157.cmd
Resource
win10-20240404-en
Behavioral task
behavioral7
Sample
6438/plugged.dll
Resource
win7-20240704-en
Behavioral task
behavioral8
Sample
6438/plugged.dll
Resource
win10-20240404-en
Behavioral task
behavioral9
Sample
Overdue.lnk
Resource
win7-20240729-en
Behavioral task
behavioral10
Sample
Overdue.lnk
Resource
win10-20240404-en
General
-
Target
6438/8157.cmd
-
Size
275B
-
MD5
533d29a067a011b9115e4fcbc94305d7
-
SHA1
1ff3aa4f90e4933ebfe20e1398dc22ecf8a2e771
-
SHA256
7bad03aef5b3d3c66dd5a4ed8a82d18643e90536b963e0711611e3266f24d054
-
SHA512
01d8fc83062dd83e15d3345e2463c6161c052e50a9cfe416de0f7ed569cc02cd63c091f5537ad0ceedf7414cad74ccbd96ab732587b873dd7152c6faadaf5d00
Malware Config
Signatures
-
Executes dropped EXE 2 IoCs
Processes:
re.exepid process 2636 re.exe 1248 -
Loads dropped DLL 1 IoCs
Processes:
cmd.exepid process 3004 cmd.exe -
System Network Configuration Discovery: Internet Connection Discovery 1 TTPs 1 IoCs
Adversaries may check for Internet connectivity on compromised systems.
-
Runs ping.exe 1 TTPs 1 IoCs
-
Suspicious use of WriteProcessMemory 6 IoCs
Processes:
cmd.exedescription pid process target process PID 3004 wrote to memory of 2100 3004 cmd.exe PING.EXE PID 3004 wrote to memory of 2100 3004 cmd.exe PING.EXE PID 3004 wrote to memory of 2100 3004 cmd.exe PING.EXE PID 3004 wrote to memory of 2636 3004 cmd.exe re.exe PID 3004 wrote to memory of 2636 3004 cmd.exe re.exe PID 3004 wrote to memory of 2636 3004 cmd.exe re.exe
Processes
-
C:\Windows\system32\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\6438\8157.cmd"1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:3004 -
C:\Windows\system32\PING.EXEping 127.0.0.12⤵
- System Network Configuration Discovery: Internet Connection Discovery
- Runs ping.exe
PID:2100
-
-
\??\c:\users\public\re.exec:\\users\\public\\re.exe 6438\plugged.dat2⤵
- Executes dropped EXE
PID:2636
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
19KB
MD559bce9f07985f8a4204f4d6554cff708
SHA1645c424974fbe5fe7a04cac73f1c23c96e1570b8
SHA256ca24aef558647274d019dfb4d7fd1506d84ec278795c30ba53b81bb36130dc57
SHA5123cf5825a9c7fb80ea0bd36775a92d07f34cd3709ed2c7c8f500f1c8baa5242768f6d575bd2477b77e3f177e7a4994d5c5bddb24c6eb43b60a6bd83ea026a8198