Analysis

  • max time kernel
    120s
  • max time network
    120s
  • platform
    windows7_x64
  • resource
    win7-20240708-en
  • resource tags

    arch:x64arch:x86image:win7-20240708-enlocale:en-usos:windows7-x64system
  • submitted
    03-08-2024 11:14

General

  • Target

    6438/8157.cmd

  • Size

    275B

  • MD5

    533d29a067a011b9115e4fcbc94305d7

  • SHA1

    1ff3aa4f90e4933ebfe20e1398dc22ecf8a2e771

  • SHA256

    7bad03aef5b3d3c66dd5a4ed8a82d18643e90536b963e0711611e3266f24d054

  • SHA512

    01d8fc83062dd83e15d3345e2463c6161c052e50a9cfe416de0f7ed569cc02cd63c091f5537ad0ceedf7414cad74ccbd96ab732587b873dd7152c6faadaf5d00

Score
7/10

Malware Config

Signatures

  • Executes dropped EXE 2 IoCs
  • Loads dropped DLL 1 IoCs
  • System Network Configuration Discovery: Internet Connection Discovery 1 TTPs 1 IoCs

    Adversaries may check for Internet connectivity on compromised systems.

  • Runs ping.exe 1 TTPs 1 IoCs
  • Suspicious use of WriteProcessMemory 6 IoCs

Processes

  • C:\Windows\system32\cmd.exe
    cmd /c "C:\Users\Admin\AppData\Local\Temp\6438\8157.cmd"
    1⤵
    • Loads dropped DLL
    • Suspicious use of WriteProcessMemory
    PID:3004
    • C:\Windows\system32\PING.EXE
      ping 127.0.0.1
      2⤵
      • System Network Configuration Discovery: Internet Connection Discovery
      • Runs ping.exe
      PID:2100
    • \??\c:\users\public\re.exe
      c:\\users\\public\\re.exe 6438\plugged.dat
      2⤵
      • Executes dropped EXE
      PID:2636

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • \Users\Public\re.exe

    Filesize

    19KB

    MD5

    59bce9f07985f8a4204f4d6554cff708

    SHA1

    645c424974fbe5fe7a04cac73f1c23c96e1570b8

    SHA256

    ca24aef558647274d019dfb4d7fd1506d84ec278795c30ba53b81bb36130dc57

    SHA512

    3cf5825a9c7fb80ea0bd36775a92d07f34cd3709ed2c7c8f500f1c8baa5242768f6d575bd2477b77e3f177e7a4994d5c5bddb24c6eb43b60a6bd83ea026a8198

  • memory/2636-5-0x0000000000190000-0x0000000000191000-memory.dmp

    Filesize

    4KB