ccbe3d3c56f67ca2eae06209050bfb086fdbc579d8511585533e841e4d9b5dfe

Analysis

max time kernel
25s
max time network
113s
platform
windows10_x64
resource
win10v20201028
submitted
09/11/2020, 20:30

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
New COVID-19 Dealership Safety rules From Government.pdf.exe
Size 209KB
Sample201109-4r8becpxc2
SHA256 ccbe3d3c56f67ca2eae06209050bfb086fdbc579d8511585533e841e4d9b5dfe
MD5 cc7a80daf5af88ee2b9c305bfcbf70f4
SHA1 1c0baeb116eb09fd08050dc5bf929256897b8cf6
SHA512 1ab41744e6a36284909e304888a18178956c0d68e85e5be7ec43ec24c233f2980437eaa51152663abee557e2e3306bab89568f7d1e7c007c223a47e6e6165c1e
MD5 SHA1 SHA512

Score

1^/10

Malware Config

Signatures

Runs ping.exe 1 TTPs 1 IoCs

Remote System Discovery

T1018

pid	Process
2924	PING.EXE

Suspicious use of WriteProcessMemory 6 IoCs

description	pid	Process	procid_target
PID 816 wrote to memory of 3876	816	New COVID-19 Dealership Safety rules From Government.pdf.exe	75
PID 816 wrote to memory of 3876	816	New COVID-19 Dealership Safety rules From Government.pdf.exe	75
PID 816 wrote to memory of 3876	816	New COVID-19 Dealership Safety rules From Government.pdf.exe	75
PID 3876 wrote to memory of 2924	3876	cmd.exe	77
PID 3876 wrote to memory of 2924	3876	cmd.exe	77
PID 3876 wrote to memory of 2924	3876	cmd.exe	77

C:\Users\Admin\AppData\Local\Temp\New COVID-19 Dealership Safety rules From Government.pdf.exe
"C:\Users\Admin\AppData\Local\Temp\New COVID-19 Dealership Safety rules From Government.pdf.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:816
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\system32\cmd.exe" /c ping 127.0.0.1 && del "C:\Users\Admin\AppData\Local\Temp\New COVID-19 Dealership Safety rules From Government.pdf.exe"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:3876
- - C:\Windows\SysWOW64\PING.EXE
    ping 127.0.0.1
    3⤵
    - Runs ping.exe
    PID:2924

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Remote System Discovery

T1018

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/816-0-0x0000000002471000-0x0000000002472000-memory.dmp

Download

memory/816-1-0x00000000026E0000-0x00000000026E1000-memory.dmp