b88584dde985bb05eef183a2f339bef9ebdf7adf3b7ce58a71e78e638e6a2123

Analysis

Target
setup.exe
Size 704KB
Sample210410-m7cdl15spe
SHA256 b88584dde985bb05eef183a2f339bef9ebdf7adf3b7ce58a71e78e638e6a2123
MD5 b749832e5d6ebfc73a61cde48a1b890b
SHA1 a6b4fda0e4ab8137b6e8cdfea85ba66ff4b11b4b
SHA512 fc197954eaa1b651ed8dc1b32b6547542281633acbfcd29a3acbb4eb5859a9aad00effcce40d76115ffbb8d0ee189b25813beabeafabee2d419dee6fa8383a21
MD5 SHA1 SHA512

Score

1^/10

Runs ping.exe 1 TTPs 1 IoCs

Remote System Discovery

pid	Process
3208	PING.EXE

Suspicious use of WriteProcessMemory 6 IoCs

description	pid	Process	procid_target
PID 4768 wrote to memory of 768	4768	setup.exe	75
PID 4768 wrote to memory of 768	4768	setup.exe	75
PID 4768 wrote to memory of 768	4768	setup.exe	75
PID 768 wrote to memory of 3208	768	cmd.exe	77
PID 768 wrote to memory of 3208	768	cmd.exe	77
PID 768 wrote to memory of 3208	768	cmd.exe	77

C:\Users\Admin\AppData\Local\Temp\setup.exe
"C:\Users\Admin\AppData\Local\Temp\setup.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:4768
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /C ping 1.1.1.1 -n 1 -w 3000 > Nul & Del /f /q "C:\Users\Admin\AppData\Local\Temp\setup.exe"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:768
- - C:\Windows\SysWOW64\PING.EXE
    ping 1.1.1.1 -n 1 -w 3000
    3⤵
    - Runs ping.exe
    PID:3208

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Remote System Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact