f91d4ff38f84a7c71517da60f6b81b2bee1e9cb8cc6673575ace3c284e6f2118

Analysis

max time kernel
93s
max time network
149s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
13/11/2024, 20:18

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
f91d4ff38f84a7c71517da60f6b81b2bee1e9cb8cc6673575ace3c284e6f2118.exe
Size 7.7MB
Sample241113-y3rl2aydmd
SHA256 f91d4ff38f84a7c71517da60f6b81b2bee1e9cb8cc6673575ace3c284e6f2118
MD5 a9d003d784f74970eef1455c844f80f4
SHA1 9214178d65ab4debfaef3b58d7dc6020a8e68373
SHA512 306ae4af9e3adb31441053dc1879f73aeee8c8283786d070d483903110cccbfdec25fab8936766b72ddc61969109d8dce70654b59595e423f5a8a3c691e7394b
SSDEEP 196608:qHAi3I4kTaU69nCl8KuOd2KfxGjWuR1FTFw:UAinkuNeMOd23j/1lF
MD5 SHA1 SHA512 SSDEEP

Score

6^/10

defense_evasion

Malware Config

Signatures

Indicator Removal: File Deletion 1 TTPs
Adversaries may delete files left behind by the actions of their intrusion activity.
defense_evasion

File Deletion
T1070.004

Suspicious use of WriteProcessMemory 2 IoCs

description	pid	Process	procid_target
PID 4788 wrote to memory of 3100	4788	f91d4ff38f84a7c71517da60f6b81b2bee1e9cb8cc6673575ace3c284e6f2118.exe	86
PID 4788 wrote to memory of 3100	4788	f91d4ff38f84a7c71517da60f6b81b2bee1e9cb8cc6673575ace3c284e6f2118.exe	86

C:\Users\Admin\AppData\Local\Temp\f91d4ff38f84a7c71517da60f6b81b2bee1e9cb8cc6673575ace3c284e6f2118.exe
"C:\Users\Admin\AppData\Local\Temp\f91d4ff38f84a7c71517da60f6b81b2bee1e9cb8cc6673575ace3c284e6f2118.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:4788
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /C del "C:\Users\Admin\AppData\Local\Temp\f91d4ff38f84a7c71517da60f6b81b2bee1e9cb8cc6673575ace3c284e6f2118.exe"
  2⤵
  PID:3100

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Indicator Removal

T1070

File Deletion

T1070.004

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/4788-0-0x0000000000400000-0x000000000100C000-memory.dmp

Download

memory/4788-1-0x0000000000400000-0x000000000100C000-memory.dmp

Download

memory/4788-2-0x0000000000400000-0x000000000100C000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads