9ed336f39d6021481ffc42c5804308a0f34a70752a6fcede544e74019827f6e9

Analysis

max time kernel
15s
max time network
16s
platform
windows7_x64
resource
win7-20240704-en
resource tags

arch:x64arch:x86image:win7-20240704-enlocale:en-usos:windows7-x64system
submitted
14/09/2024, 17:17

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

80a5b6a30ec939237e25b30d6a3d3ea0N.exe
Size

316KB
MD5

80a5b6a30ec939237e25b30d6a3d3ea0
SHA1

db6715e34479d44551a3fa65c91c916beccaad7f
SHA256

9ed336f39d6021481ffc42c5804308a0f34a70752a6fcede544e74019827f6e9
SHA512

80ab4f3e4a0cfaa11f9a00f791d210be73a543439cd6fcf7ec5493ffdddc2210dafa6874e8689fd61329de6d625d8254621ebebca4e56ca5d7b93b6ebf05002d
SSDEEP

6144:FUORK1ttbV3kSobTYZGiNdniCoh+KiEnoVLzH1hU4:FytbV3kSoXaLnTosltHjD

Score

7^/10

discovery

Malware Config

Signatures

Deletes itself 1 IoCs

pid	Process
2356	cmd.exe

System Network Configuration Discovery: Internet Connection Discovery 1 TTPs 2 IoCs

Adversaries may check for Internet connectivity on compromised systems.

discovery

Internet Connection Discovery

T1016.001

pid	Process
2676	PING.EXE
2356	cmd.exe

Runs ping.exe 1 TTPs 1 IoCs

Remote System Discovery

T1018

pid	Process
2676	PING.EXE

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
2188	80a5b6a30ec939237e25b30d6a3d3ea0N.exe
2188	80a5b6a30ec939237e25b30d6a3d3ea0N.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	2188	80a5b6a30ec939237e25b30d6a3d3ea0N.exe

Suspicious use of WriteProcessMemory 6 IoCs

description	pid	Process	procid_target
PID 2188 wrote to memory of 2356	2188	80a5b6a30ec939237e25b30d6a3d3ea0N.exe	30
PID 2188 wrote to memory of 2356	2188	80a5b6a30ec939237e25b30d6a3d3ea0N.exe	30
PID 2188 wrote to memory of 2356	2188	80a5b6a30ec939237e25b30d6a3d3ea0N.exe	30
PID 2356 wrote to memory of 2676	2356	cmd.exe	32
PID 2356 wrote to memory of 2676	2356	cmd.exe	32
PID 2356 wrote to memory of 2676	2356	cmd.exe	32

C:\Users\Admin\AppData\Local\Temp\80a5b6a30ec939237e25b30d6a3d3ea0N.exe
"C:\Users\Admin\AppData\Local\Temp\80a5b6a30ec939237e25b30d6a3d3ea0N.exe"
1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2188
- C:\Windows\system32\cmd.exe
  cmd.exe /C ping 1.1.1.1 -n 1 -w 6000 > Nul & Del "C:\Users\Admin\AppData\Local\Temp\80a5b6a30ec939237e25b30d6a3d3ea0N.exe"
  2⤵
  - Deletes itself
  - System Network Configuration Discovery: Internet Connection Discovery
  - Suspicious use of WriteProcessMemory
  PID:2356
- - C:\Windows\system32\PING.EXE
    ping 1.1.1.1 -n 1 -w 6000
    3⤵
    - System Network Configuration Discovery: Internet Connection Discovery
    - Runs ping.exe
    PID:2676

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Remote System Discovery

T1018

System Network Configuration Discovery

T1016

Internet Connection Discovery

T1016.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads