c1efca753dedafb2fa206085cc45583e9af9e233a3248e958a5e1ece7982837f

Analysis

max time kernel
45s
max time network
49s
platform
windows7_x64
resource
win7-20220901-en
resource tags

arch:x64arch:x86image:win7-20220901-enlocale:en-usos:windows7-x64system
submitted
06-10-2022 16:07

Target

6438/1722.cmd
Size

259B
MD5

3c3c6861a7b06edf3d7ab40e6a239eb7
SHA1

f9b416533bcabd4096ab3cd1b138194b0d7bb47f
SHA256

4ce57b83a2c32680ec5c45efc486e38e6985cdcea78593882ce041940014dbfa
SHA512

9830d3370d412d714e395c02b56dd887d162611be83f8aa75db84ee480b5b09d634db24d71a165bdcd346fe7481cf5249dd17ea8ab1c9aa50689f49709616923

Score

8^/10

Executes dropped EXE 2 IoCs

Processes:

re.exe

pid process

1760 re.exe
1400
Loads dropped DLL 1 IoCs

Processes:

cmd.exe

pid process

1900 cmd.exe
Runs ping.exe 1 TTPs 1 IoCs

Remote System Discovery
T1018

Processes:

PING.EXE

pid process

2016 PING.EXE

pid	process
1760	re.exe
1400

pid	process
1900	cmd.exe

pid	process
2016	PING.EXE

Suspicious use of WriteProcessMemory 6 IoCs

Processes:

cmd.exe

description	pid	process	target process
PID 1900 wrote to memory of 2016	1900	cmd.exe	PING.EXE
PID 1900 wrote to memory of 2016	1900	cmd.exe	PING.EXE
PID 1900 wrote to memory of 2016	1900	cmd.exe	PING.EXE
PID 1900 wrote to memory of 1760	1900	cmd.exe	re.exe
PID 1900 wrote to memory of 1760	1900	cmd.exe	re.exe
PID 1900 wrote to memory of 1760	1900	cmd.exe	re.exe

\??\c:\users\public\re.exe
c:\\users\\public\\re.exe 6438\fearfully.dat
2⤵
- Executes dropped EXE
PID:1760

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Remote System Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

C:\Users\Public\re.exe

Filesize
19KB

MD5
59bce9f07985f8a4204f4d6554cff708

SHA1
645c424974fbe5fe7a04cac73f1c23c96e1570b8

SHA256
ca24aef558647274d019dfb4d7fd1506d84ec278795c30ba53b81bb36130dc57

SHA512
3cf5825a9c7fb80ea0bd36775a92d07f34cd3709ed2c7c8f500f1c8baa5242768f6d575bd2477b77e3f177e7a4994d5c5bddb24c6eb43b60a6bd83ea026a8198

Download Submit
\Users\Public\re.exe

Filesize
19KB

MD5
59bce9f07985f8a4204f4d6554cff708

SHA1
645c424974fbe5fe7a04cac73f1c23c96e1570b8

SHA256
ca24aef558647274d019dfb4d7fd1506d84ec278795c30ba53b81bb36130dc57

SHA512
3cf5825a9c7fb80ea0bd36775a92d07f34cd3709ed2c7c8f500f1c8baa5242768f6d575bd2477b77e3f177e7a4994d5c5bddb24c6eb43b60a6bd83ea026a8198

Download Submit
\Users\Public\re.exe

Filesize
19KB

MD5
59bce9f07985f8a4204f4d6554cff708

SHA1
645c424974fbe5fe7a04cac73f1c23c96e1570b8

SHA256
ca24aef558647274d019dfb4d7fd1506d84ec278795c30ba53b81bb36130dc57

SHA512
3cf5825a9c7fb80ea0bd36775a92d07f34cd3709ed2c7c8f500f1c8baa5242768f6d575bd2477b77e3f177e7a4994d5c5bddb24c6eb43b60a6bd83ea026a8198

Download Submit
memory/1760-56-0x0000000000000000-mapping.dmp

Download
memory/1760-58-0x000007FEFBEE1000-0x000007FEFBEE3000-memory.dmp

Filesize
8KB

Download
memory/2016-54-0x0000000000000000-mapping.dmp

Download