b4bb497039f2c1ca8c7eaf592bf32566b8fbb2f657f23555bb14c4d24db3c622

Resubmissions

09/08/2024, 21:36

240809-1f9kfatgrg 6

09/08/2024, 21:26

240809-1an2jstend 8

Analysis

max time kernel
121s
max time network
134s
platform
windows7_x64
resource
win7-20240705-en
resource tags

arch:x64arch:x86image:win7-20240705-enlocale:en-usos:windows7-x64system
submitted
09/08/2024, 21:36

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

KASU PACK V.3/Ping Tweaker/KASU PING TWEAKER (RUN AS ADMIN).bat
Size

1KB
MD5

aaf93684d2b71892aad5185e018cc137
SHA1

2eba4ede105d48b13ce5b4ca56bac284a92b5ccf
SHA256

b24b8ff1d7f131f30da67b165e44f5e1a31ccbf001e8e31c2fb5cfd09a5c629a
SHA512

e3f0c364fdd0b0e239a94f8ee1a5482ff65875d37c402904b316652a28b8add8138a4020c677f2616caab2988ed8b17862b320720d6439082acb83961f306294

Score

3^/10

discovery

Malware Config

Signatures

System Network Configuration Discovery: Internet Connection Discovery 1 TTPs 1 IoCs

Adversaries may check for Internet connectivity on compromised systems.

discovery

Internet Connection Discovery

T1016.001

pid	Process
2072	cmd.exe

Delays execution with timeout.exe 1 IoCs

evasion

pid	Process
2928	timeout.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2072 wrote to memory of 2928	2072	cmd.exe	31
PID 2072 wrote to memory of 2928	2072	cmd.exe	31
PID 2072 wrote to memory of 2928	2072	cmd.exe	31

C:\Windows\system32\cmd.exe
cmd /c "C:\Users\Admin\AppData\Local\Temp\KASU PACK V.3\Ping Tweaker\KASU PING TWEAKER (RUN AS ADMIN).bat"
1⤵
- System Network Configuration Discovery: Internet Connection Discovery
- Suspicious use of WriteProcessMemory
PID:2072
- C:\Windows\system32\timeout.exe
  timeout /t 5 /nobreak
  2⤵
  - Delays execution with timeout.exe
  PID:2928

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Network Configuration Discovery

T1016

Internet Connection Discovery

T1016.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Windows 7 deprecation

Loading Replay Monitor...