f7ed399d5cfad881ce41d8910b7ce7d09828d4df429ed8cf9f42ced125ac3ce5

Analysis

max time kernel
63s
max time network
45s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
04/10/2022, 02:59

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

f7ed399d5cfad881ce41d8910b7ce7d09828d4df429ed8cf9f42ced125ac3ce5.exe
Size

885KB
MD5

6be61d0d9c2b45817485c18d8fe0eb50
SHA1

8f1c7b19a5011cef6709a6647c0a41748a8d1437
SHA256

f7ed399d5cfad881ce41d8910b7ce7d09828d4df429ed8cf9f42ced125ac3ce5
SHA512

e41bc68450646d422e1bb889146471566c7f9db854cee1d6208cf7ee90b94152bc1ac94149f786184debfac41c7955cff3fc2a0af3e7fa67b7c3210afb334d72
SSDEEP

12288:g9DTr28uDKxonlsY12eV2N3hGxAtGchnYOavZSaibuXixaBdDzOT3UDGcXN:CDf28il12N317hhavZSaWuXVregDGS

Score

5^/10

Malware Config

Signatures

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 1928 set thread context of 1552	1928	f7ed399d5cfad881ce41d8910b7ce7d09828d4df429ed8cf9f42ced125ac3ce5.exe	27

Runs ping.exe 1 TTPs 10 IoCs

Remote System Discovery

T1018

pid	Process
1176	ping.exe
1596	ping.exe
1164	ping.exe
1204	ping.exe
1824	ping.exe
544	ping.exe
1148	ping.exe
1508	ping.exe
316	ping.exe
848	ping.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
1928	f7ed399d5cfad881ce41d8910b7ce7d09828d4df429ed8cf9f42ced125ac3ce5.exe
1552	f7ed399d5cfad881ce41d8910b7ce7d09828d4df429ed8cf9f42ced125ac3ce5.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	1928	f7ed399d5cfad881ce41d8910b7ce7d09828d4df429ed8cf9f42ced125ac3ce5.exe
Token: SeDebugPrivilege	1552	f7ed399d5cfad881ce41d8910b7ce7d09828d4df429ed8cf9f42ced125ac3ce5.exe

Suspicious use of WriteProcessMemory 51 IoCs

description	pid	Process	procid_target
PID 1928 wrote to memory of 1552	1928	f7ed399d5cfad881ce41d8910b7ce7d09828d4df429ed8cf9f42ced125ac3ce5.exe	27
PID 1928 wrote to memory of 1552	1928	f7ed399d5cfad881ce41d8910b7ce7d09828d4df429ed8cf9f42ced125ac3ce5.exe	27
PID 1928 wrote to memory of 1552	1928	f7ed399d5cfad881ce41d8910b7ce7d09828d4df429ed8cf9f42ced125ac3ce5.exe	27
PID 1928 wrote to memory of 1552	1928	f7ed399d5cfad881ce41d8910b7ce7d09828d4df429ed8cf9f42ced125ac3ce5.exe	27
PID 1928 wrote to memory of 1552	1928	f7ed399d5cfad881ce41d8910b7ce7d09828d4df429ed8cf9f42ced125ac3ce5.exe	27
PID 1928 wrote to memory of 1552	1928	f7ed399d5cfad881ce41d8910b7ce7d09828d4df429ed8cf9f42ced125ac3ce5.exe	27
PID 1928 wrote to memory of 1552	1928	f7ed399d5cfad881ce41d8910b7ce7d09828d4df429ed8cf9f42ced125ac3ce5.exe	27
PID 1928 wrote to memory of 1552	1928	f7ed399d5cfad881ce41d8910b7ce7d09828d4df429ed8cf9f42ced125ac3ce5.exe	27
PID 1928 wrote to memory of 1552	1928	f7ed399d5cfad881ce41d8910b7ce7d09828d4df429ed8cf9f42ced125ac3ce5.exe	27
PID 1928 wrote to memory of 1552	1928	f7ed399d5cfad881ce41d8910b7ce7d09828d4df429ed8cf9f42ced125ac3ce5.exe	27
PID 1928 wrote to memory of 1552	1928	f7ed399d5cfad881ce41d8910b7ce7d09828d4df429ed8cf9f42ced125ac3ce5.exe	27
PID 1928 wrote to memory of 1508	1928	f7ed399d5cfad881ce41d8910b7ce7d09828d4df429ed8cf9f42ced125ac3ce5.exe	28
PID 1928 wrote to memory of 1508	1928	f7ed399d5cfad881ce41d8910b7ce7d09828d4df429ed8cf9f42ced125ac3ce5.exe	28
PID 1928 wrote to memory of 1508	1928	f7ed399d5cfad881ce41d8910b7ce7d09828d4df429ed8cf9f42ced125ac3ce5.exe	28
PID 1928 wrote to memory of 1508	1928	f7ed399d5cfad881ce41d8910b7ce7d09828d4df429ed8cf9f42ced125ac3ce5.exe	28
PID 1928 wrote to memory of 1824	1928	f7ed399d5cfad881ce41d8910b7ce7d09828d4df429ed8cf9f42ced125ac3ce5.exe	30
PID 1928 wrote to memory of 1824	1928	f7ed399d5cfad881ce41d8910b7ce7d09828d4df429ed8cf9f42ced125ac3ce5.exe	30
PID 1928 wrote to memory of 1824	1928	f7ed399d5cfad881ce41d8910b7ce7d09828d4df429ed8cf9f42ced125ac3ce5.exe	30
PID 1928 wrote to memory of 1824	1928	f7ed399d5cfad881ce41d8910b7ce7d09828d4df429ed8cf9f42ced125ac3ce5.exe	30
PID 1928 wrote to memory of 316	1928	f7ed399d5cfad881ce41d8910b7ce7d09828d4df429ed8cf9f42ced125ac3ce5.exe	32
PID 1928 wrote to memory of 316	1928	f7ed399d5cfad881ce41d8910b7ce7d09828d4df429ed8cf9f42ced125ac3ce5.exe	32
PID 1928 wrote to memory of 316	1928	f7ed399d5cfad881ce41d8910b7ce7d09828d4df429ed8cf9f42ced125ac3ce5.exe	32
PID 1928 wrote to memory of 316	1928	f7ed399d5cfad881ce41d8910b7ce7d09828d4df429ed8cf9f42ced125ac3ce5.exe	32
PID 1928 wrote to memory of 544	1928	f7ed399d5cfad881ce41d8910b7ce7d09828d4df429ed8cf9f42ced125ac3ce5.exe	34
PID 1928 wrote to memory of 544	1928	f7ed399d5cfad881ce41d8910b7ce7d09828d4df429ed8cf9f42ced125ac3ce5.exe	34
PID 1928 wrote to memory of 544	1928	f7ed399d5cfad881ce41d8910b7ce7d09828d4df429ed8cf9f42ced125ac3ce5.exe	34
PID 1928 wrote to memory of 544	1928	f7ed399d5cfad881ce41d8910b7ce7d09828d4df429ed8cf9f42ced125ac3ce5.exe	34
PID 1928 wrote to memory of 1148	1928	f7ed399d5cfad881ce41d8910b7ce7d09828d4df429ed8cf9f42ced125ac3ce5.exe	36
PID 1928 wrote to memory of 1148	1928	f7ed399d5cfad881ce41d8910b7ce7d09828d4df429ed8cf9f42ced125ac3ce5.exe	36
PID 1928 wrote to memory of 1148	1928	f7ed399d5cfad881ce41d8910b7ce7d09828d4df429ed8cf9f42ced125ac3ce5.exe	36
PID 1928 wrote to memory of 1148	1928	f7ed399d5cfad881ce41d8910b7ce7d09828d4df429ed8cf9f42ced125ac3ce5.exe	36
PID 1928 wrote to memory of 848	1928	f7ed399d5cfad881ce41d8910b7ce7d09828d4df429ed8cf9f42ced125ac3ce5.exe	38
PID 1928 wrote to memory of 848	1928	f7ed399d5cfad881ce41d8910b7ce7d09828d4df429ed8cf9f42ced125ac3ce5.exe	38
PID 1928 wrote to memory of 848	1928	f7ed399d5cfad881ce41d8910b7ce7d09828d4df429ed8cf9f42ced125ac3ce5.exe	38
PID 1928 wrote to memory of 848	1928	f7ed399d5cfad881ce41d8910b7ce7d09828d4df429ed8cf9f42ced125ac3ce5.exe	38
PID 1928 wrote to memory of 1176	1928	f7ed399d5cfad881ce41d8910b7ce7d09828d4df429ed8cf9f42ced125ac3ce5.exe	40
PID 1928 wrote to memory of 1176	1928	f7ed399d5cfad881ce41d8910b7ce7d09828d4df429ed8cf9f42ced125ac3ce5.exe	40
PID 1928 wrote to memory of 1176	1928	f7ed399d5cfad881ce41d8910b7ce7d09828d4df429ed8cf9f42ced125ac3ce5.exe	40
PID 1928 wrote to memory of 1176	1928	f7ed399d5cfad881ce41d8910b7ce7d09828d4df429ed8cf9f42ced125ac3ce5.exe	40
PID 1928 wrote to memory of 1596	1928	f7ed399d5cfad881ce41d8910b7ce7d09828d4df429ed8cf9f42ced125ac3ce5.exe	42
PID 1928 wrote to memory of 1596	1928	f7ed399d5cfad881ce41d8910b7ce7d09828d4df429ed8cf9f42ced125ac3ce5.exe	42
PID 1928 wrote to memory of 1596	1928	f7ed399d5cfad881ce41d8910b7ce7d09828d4df429ed8cf9f42ced125ac3ce5.exe	42
PID 1928 wrote to memory of 1596	1928	f7ed399d5cfad881ce41d8910b7ce7d09828d4df429ed8cf9f42ced125ac3ce5.exe	42
PID 1928 wrote to memory of 1164	1928	f7ed399d5cfad881ce41d8910b7ce7d09828d4df429ed8cf9f42ced125ac3ce5.exe	44
PID 1928 wrote to memory of 1164	1928	f7ed399d5cfad881ce41d8910b7ce7d09828d4df429ed8cf9f42ced125ac3ce5.exe	44
PID 1928 wrote to memory of 1164	1928	f7ed399d5cfad881ce41d8910b7ce7d09828d4df429ed8cf9f42ced125ac3ce5.exe	44
PID 1928 wrote to memory of 1164	1928	f7ed399d5cfad881ce41d8910b7ce7d09828d4df429ed8cf9f42ced125ac3ce5.exe	44
PID 1928 wrote to memory of 1204	1928	f7ed399d5cfad881ce41d8910b7ce7d09828d4df429ed8cf9f42ced125ac3ce5.exe	46
PID 1928 wrote to memory of 1204	1928	f7ed399d5cfad881ce41d8910b7ce7d09828d4df429ed8cf9f42ced125ac3ce5.exe	46
PID 1928 wrote to memory of 1204	1928	f7ed399d5cfad881ce41d8910b7ce7d09828d4df429ed8cf9f42ced125ac3ce5.exe	46
PID 1928 wrote to memory of 1204	1928	f7ed399d5cfad881ce41d8910b7ce7d09828d4df429ed8cf9f42ced125ac3ce5.exe	46

C:\Users\Admin\AppData\Local\Temp\f7ed399d5cfad881ce41d8910b7ce7d09828d4df429ed8cf9f42ced125ac3ce5.exe
"C:\Users\Admin\AppData\Local\Temp\f7ed399d5cfad881ce41d8910b7ce7d09828d4df429ed8cf9f42ced125ac3ce5.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1928
- C:\Users\Admin\AppData\Local\Temp\f7ed399d5cfad881ce41d8910b7ce7d09828d4df429ed8cf9f42ced125ac3ce5.exe
  "C:\Users\Admin\AppData\Local\Temp\f7ed399d5cfad881ce41d8910b7ce7d09828d4df429ed8cf9f42ced125ac3ce5.exe"
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:1552
- C:\Windows\SysWOW64\ping.exe
  ping google.com
  2⤵
  - Runs ping.exe
  PID:1508
- C:\Windows\SysWOW64\ping.exe
  ping google.com
  2⤵
  - Runs ping.exe
  PID:1824
- C:\Windows\SysWOW64\ping.exe
  ping google.com
  2⤵
  - Runs ping.exe
  PID:316
- C:\Windows\SysWOW64\ping.exe
  ping google.com
  2⤵
  - Runs ping.exe
  PID:544
- C:\Windows\SysWOW64\ping.exe
  ping google.com
  2⤵
  - Runs ping.exe
  PID:1148
- C:\Windows\SysWOW64\ping.exe
  ping google.com
  2⤵
  - Runs ping.exe
  PID:848
- C:\Windows\SysWOW64\ping.exe
  ping google.com
  2⤵
  - Runs ping.exe
  PID:1176
- C:\Windows\SysWOW64\ping.exe
  ping google.com
  2⤵
  - Runs ping.exe
  PID:1596
- C:\Windows\SysWOW64\ping.exe
  ping google.com
  2⤵
  - Runs ping.exe
  PID:1164
- C:\Windows\SysWOW64\ping.exe
  ping google.com
  2⤵
  - Runs ping.exe
  PID:1204

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Remote System Discovery

T1018

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1552-68-0x0000000000400000-0x0000000000486000-memory.dmp

Filesize
536KB

Download
memory/1552-91-0x0000000000400000-0x0000000000486000-memory.dmp

Filesize
536KB

Download
memory/1552-55-0x0000000000400000-0x0000000000486000-memory.dmp

Filesize
536KB

Download
memory/1552-56-0x0000000000400000-0x0000000000486000-memory.dmp

Filesize
536KB

Download
memory/1552-73-0x0000000000400000-0x0000000000486000-memory.dmp

Filesize
536KB

Download
memory/1552-74-0x0000000000400000-0x0000000000486000-memory.dmp

Filesize
536KB

Download
memory/1552-75-0x0000000000400000-0x0000000000486000-memory.dmp

Filesize
536KB

Download
memory/1552-77-0x0000000000400000-0x0000000000486000-memory.dmp

Filesize
536KB

Download
memory/1552-78-0x0000000000400000-0x0000000000486000-memory.dmp

Filesize
536KB

Download
memory/1552-76-0x0000000000400000-0x0000000000486000-memory.dmp

Filesize
536KB

Download
memory/1552-79-0x0000000000400000-0x0000000000486000-memory.dmp

Filesize
536KB

Download
memory/1552-82-0x0000000000400000-0x0000000000486000-memory.dmp

Filesize
536KB

Download
memory/1552-81-0x0000000000400000-0x0000000000486000-memory.dmp

Filesize
536KB

Download
memory/1552-84-0x0000000000400000-0x0000000000486000-memory.dmp

Filesize
536KB

Download
memory/1552-87-0x0000000000400000-0x0000000000486000-memory.dmp

Filesize
536KB

Download
memory/1552-86-0x0000000000400000-0x0000000000486000-memory.dmp

Filesize
536KB

Download
memory/1552-66-0x0000000000400000-0x0000000000486000-memory.dmp

Filesize
536KB

Download
memory/1552-90-0x0000000000400000-0x0000000000486000-memory.dmp

Filesize
536KB

Download
memory/1552-93-0x0000000000400000-0x0000000000486000-memory.dmp

Filesize
536KB

Download
memory/1552-94-0x0000000074940000-0x0000000074EEB000-memory.dmp

Filesize
5.7MB

Download
memory/1552-58-0x0000000000400000-0x0000000000486000-memory.dmp

Filesize
536KB

Download
memory/1552-63-0x0000000000400000-0x0000000000486000-memory.dmp

Filesize
536KB

Download
memory/1552-102-0x0000000074940000-0x0000000074EEB000-memory.dmp

Filesize
5.7MB

Download
memory/1552-62-0x0000000000400000-0x0000000000486000-memory.dmp

Filesize
536KB

Download
memory/1552-99-0x0000000074940000-0x0000000074EEB000-memory.dmp

Filesize
5.7MB

Download
memory/1552-61-0x0000000000400000-0x0000000000486000-memory.dmp

Filesize
536KB

Download
memory/1552-60-0x0000000000400000-0x0000000000486000-memory.dmp

Filesize
536KB

Download
memory/1928-97-0x0000000074940000-0x0000000074EEB000-memory.dmp

Filesize
5.7MB

Download
memory/1928-72-0x0000000074940000-0x0000000074EEB000-memory.dmp

Filesize
5.7MB

Download
memory/1928-54-0x0000000075E11000-0x0000000075E13000-memory.dmp

Filesize
8KB

Download
memory/1928-107-0x0000000074940000-0x0000000074EEB000-memory.dmp

Filesize
5.7MB

Download