f7ed399d5cfad881ce41d8910b7ce7d09828d4df429ed8cf9f42ced125ac3ce5

Analysis

max time kernel
117s
max time network
135s
platform
windows10-2004_x64
resource
win10v2004-20220901-en
resource tags

arch:x64arch:x86image:win10v2004-20220901-enlocale:en-usos:windows10-2004-x64system
submitted
04/10/2022, 02:59

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

f7ed399d5cfad881ce41d8910b7ce7d09828d4df429ed8cf9f42ced125ac3ce5.exe
Size

885KB
MD5

6be61d0d9c2b45817485c18d8fe0eb50
SHA1

8f1c7b19a5011cef6709a6647c0a41748a8d1437
SHA256

f7ed399d5cfad881ce41d8910b7ce7d09828d4df429ed8cf9f42ced125ac3ce5
SHA512

e41bc68450646d422e1bb889146471566c7f9db854cee1d6208cf7ee90b94152bc1ac94149f786184debfac41c7955cff3fc2a0af3e7fa67b7c3210afb334d72
SSDEEP

12288:g9DTr28uDKxonlsY12eV2N3hGxAtGchnYOavZSaibuXixaBdDzOT3UDGcXN:CDf28il12N317hhavZSaWuXVregDGS

Score

1^/10

Malware Config

Signatures

Runs ping.exe 1 TTPs 10 IoCs

Remote System Discovery

T1018

pid	Process
4788	ping.exe
4684	ping.exe
1296	ping.exe
4344	ping.exe
4064	ping.exe
3284	ping.exe
772	ping.exe
1064	ping.exe
4208	ping.exe
868	ping.exe

Suspicious behavior: EnumeratesProcesses 3 IoCs

pid	Process
856	f7ed399d5cfad881ce41d8910b7ce7d09828d4df429ed8cf9f42ced125ac3ce5.exe
856	f7ed399d5cfad881ce41d8910b7ce7d09828d4df429ed8cf9f42ced125ac3ce5.exe
856	f7ed399d5cfad881ce41d8910b7ce7d09828d4df429ed8cf9f42ced125ac3ce5.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	856	f7ed399d5cfad881ce41d8910b7ce7d09828d4df429ed8cf9f42ced125ac3ce5.exe

Suspicious use of WriteProcessMemory 33 IoCs

description	pid	Process	procid_target
PID 856 wrote to memory of 3812	856	f7ed399d5cfad881ce41d8910b7ce7d09828d4df429ed8cf9f42ced125ac3ce5.exe	86
PID 856 wrote to memory of 3812	856	f7ed399d5cfad881ce41d8910b7ce7d09828d4df429ed8cf9f42ced125ac3ce5.exe	86
PID 856 wrote to memory of 3812	856	f7ed399d5cfad881ce41d8910b7ce7d09828d4df429ed8cf9f42ced125ac3ce5.exe	86
PID 856 wrote to memory of 4344	856	f7ed399d5cfad881ce41d8910b7ce7d09828d4df429ed8cf9f42ced125ac3ce5.exe	87
PID 856 wrote to memory of 4344	856	f7ed399d5cfad881ce41d8910b7ce7d09828d4df429ed8cf9f42ced125ac3ce5.exe	87
PID 856 wrote to memory of 4344	856	f7ed399d5cfad881ce41d8910b7ce7d09828d4df429ed8cf9f42ced125ac3ce5.exe	87
PID 856 wrote to memory of 4064	856	f7ed399d5cfad881ce41d8910b7ce7d09828d4df429ed8cf9f42ced125ac3ce5.exe	89
PID 856 wrote to memory of 4064	856	f7ed399d5cfad881ce41d8910b7ce7d09828d4df429ed8cf9f42ced125ac3ce5.exe	89
PID 856 wrote to memory of 4064	856	f7ed399d5cfad881ce41d8910b7ce7d09828d4df429ed8cf9f42ced125ac3ce5.exe	89
PID 856 wrote to memory of 3284	856	f7ed399d5cfad881ce41d8910b7ce7d09828d4df429ed8cf9f42ced125ac3ce5.exe	91
PID 856 wrote to memory of 3284	856	f7ed399d5cfad881ce41d8910b7ce7d09828d4df429ed8cf9f42ced125ac3ce5.exe	91
PID 856 wrote to memory of 3284	856	f7ed399d5cfad881ce41d8910b7ce7d09828d4df429ed8cf9f42ced125ac3ce5.exe	91
PID 856 wrote to memory of 772	856	f7ed399d5cfad881ce41d8910b7ce7d09828d4df429ed8cf9f42ced125ac3ce5.exe	93
PID 856 wrote to memory of 772	856	f7ed399d5cfad881ce41d8910b7ce7d09828d4df429ed8cf9f42ced125ac3ce5.exe	93
PID 856 wrote to memory of 772	856	f7ed399d5cfad881ce41d8910b7ce7d09828d4df429ed8cf9f42ced125ac3ce5.exe	93
PID 856 wrote to memory of 1064	856	f7ed399d5cfad881ce41d8910b7ce7d09828d4df429ed8cf9f42ced125ac3ce5.exe	95
PID 856 wrote to memory of 1064	856	f7ed399d5cfad881ce41d8910b7ce7d09828d4df429ed8cf9f42ced125ac3ce5.exe	95
PID 856 wrote to memory of 1064	856	f7ed399d5cfad881ce41d8910b7ce7d09828d4df429ed8cf9f42ced125ac3ce5.exe	95
PID 856 wrote to memory of 4788	856	f7ed399d5cfad881ce41d8910b7ce7d09828d4df429ed8cf9f42ced125ac3ce5.exe	97
PID 856 wrote to memory of 4788	856	f7ed399d5cfad881ce41d8910b7ce7d09828d4df429ed8cf9f42ced125ac3ce5.exe	97
PID 856 wrote to memory of 4788	856	f7ed399d5cfad881ce41d8910b7ce7d09828d4df429ed8cf9f42ced125ac3ce5.exe	97
PID 856 wrote to memory of 4208	856	f7ed399d5cfad881ce41d8910b7ce7d09828d4df429ed8cf9f42ced125ac3ce5.exe	99
PID 856 wrote to memory of 4208	856	f7ed399d5cfad881ce41d8910b7ce7d09828d4df429ed8cf9f42ced125ac3ce5.exe	99
PID 856 wrote to memory of 4208	856	f7ed399d5cfad881ce41d8910b7ce7d09828d4df429ed8cf9f42ced125ac3ce5.exe	99
PID 856 wrote to memory of 868	856	f7ed399d5cfad881ce41d8910b7ce7d09828d4df429ed8cf9f42ced125ac3ce5.exe	101
PID 856 wrote to memory of 868	856	f7ed399d5cfad881ce41d8910b7ce7d09828d4df429ed8cf9f42ced125ac3ce5.exe	101
PID 856 wrote to memory of 868	856	f7ed399d5cfad881ce41d8910b7ce7d09828d4df429ed8cf9f42ced125ac3ce5.exe	101
PID 856 wrote to memory of 4684	856	f7ed399d5cfad881ce41d8910b7ce7d09828d4df429ed8cf9f42ced125ac3ce5.exe	103
PID 856 wrote to memory of 4684	856	f7ed399d5cfad881ce41d8910b7ce7d09828d4df429ed8cf9f42ced125ac3ce5.exe	103
PID 856 wrote to memory of 4684	856	f7ed399d5cfad881ce41d8910b7ce7d09828d4df429ed8cf9f42ced125ac3ce5.exe	103
PID 856 wrote to memory of 1296	856	f7ed399d5cfad881ce41d8910b7ce7d09828d4df429ed8cf9f42ced125ac3ce5.exe	107
PID 856 wrote to memory of 1296	856	f7ed399d5cfad881ce41d8910b7ce7d09828d4df429ed8cf9f42ced125ac3ce5.exe	107
PID 856 wrote to memory of 1296	856	f7ed399d5cfad881ce41d8910b7ce7d09828d4df429ed8cf9f42ced125ac3ce5.exe	107

C:\Users\Admin\AppData\Local\Temp\f7ed399d5cfad881ce41d8910b7ce7d09828d4df429ed8cf9f42ced125ac3ce5.exe
"C:\Users\Admin\AppData\Local\Temp\f7ed399d5cfad881ce41d8910b7ce7d09828d4df429ed8cf9f42ced125ac3ce5.exe"
1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:856
- C:\Users\Admin\AppData\Local\Temp\f7ed399d5cfad881ce41d8910b7ce7d09828d4df429ed8cf9f42ced125ac3ce5.exe
  "C:\Users\Admin\AppData\Local\Temp\f7ed399d5cfad881ce41d8910b7ce7d09828d4df429ed8cf9f42ced125ac3ce5.exe"
  2⤵
  PID:3812
- C:\Windows\SysWOW64\ping.exe
  ping google.com
  2⤵
  - Runs ping.exe
  PID:4344
- C:\Windows\SysWOW64\ping.exe
  ping google.com
  2⤵
  - Runs ping.exe
  PID:4064
- C:\Windows\SysWOW64\ping.exe
  ping google.com
  2⤵
  - Runs ping.exe
  PID:3284
- C:\Windows\SysWOW64\ping.exe
  ping google.com
  2⤵
  - Runs ping.exe
  PID:772
- C:\Windows\SysWOW64\ping.exe
  ping google.com
  2⤵
  - Runs ping.exe
  PID:1064
- C:\Windows\SysWOW64\ping.exe
  ping google.com
  2⤵
  - Runs ping.exe
  PID:4788
- C:\Windows\SysWOW64\ping.exe
  ping google.com
  2⤵
  - Runs ping.exe
  PID:4208
- C:\Windows\SysWOW64\ping.exe
  ping google.com
  2⤵
  - Runs ping.exe
  PID:868
- C:\Windows\SysWOW64\ping.exe
  ping google.com
  2⤵
  - Runs ping.exe
  PID:4684
- C:\Windows\SysWOW64\ping.exe
  ping google.com
  2⤵
  - Runs ping.exe
  PID:1296

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Remote System Discovery

T1018

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/856-146-0x0000000074F10000-0x00000000754C1000-memory.dmp

Filesize
5.7MB

Download
memory/856-133-0x0000000074F10000-0x00000000754C1000-memory.dmp

Filesize
5.7MB

Download
memory/856-138-0x0000000074F10000-0x00000000754C1000-memory.dmp

Filesize
5.7MB

Download