814299de88cde77b7f06476f2abf8f6719d3b8d2184796114c56a6ee08833e61

Analysis

max time kernel
43s
max time network
46s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
06-10-2022 17:49

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

3586/6190.cmd
Size

187B
MD5

5f1a86f574068771662310dd27e4dda8
SHA1

f94bcb88b0ea66b537b509de72340c1288cbe12b
SHA256

7d5bdd81da74a8908216ef80642588eec11009c06decfa86aa9ef321aa1ca854
SHA512

931392aa68db4ea9c9d58c32b5cfd087dc93f2e7a179b8f8ba05bea6ab028ec1afe09af8a9e10f0d65be9df9cdf54814d18a2d6d173057e12baa79b25e2e9538

Score

8^/10

Malware Config

Signatures

Executes dropped EXE 1 IoCs

Processes:

my.exe

pid process

1516 my.exe
Loads dropped DLL 1 IoCs

Processes:

cmd.exe

pid process

240 cmd.exe
Runs ping.exe 1 TTPs 1 IoCs

Remote System Discovery
T1018

Processes:

PING.EXE

pid process

1164 PING.EXE

pid	process
1516	my.exe

pid	process
240	cmd.exe

pid	process
1164	PING.EXE

Suspicious use of WriteProcessMemory 6 IoCs

Processes:

cmd.exe

description	pid	process	target process
PID 240 wrote to memory of 1164	240	cmd.exe	PING.EXE
PID 240 wrote to memory of 1164	240	cmd.exe	PING.EXE
PID 240 wrote to memory of 1164	240	cmd.exe	PING.EXE
PID 240 wrote to memory of 1516	240	cmd.exe	my.exe
PID 240 wrote to memory of 1516	240	cmd.exe	my.exe
PID 240 wrote to memory of 1516	240	cmd.exe	my.exe

C:\Windows\system32\cmd.exe
cmd /c "C:\Users\Admin\AppData\Local\Temp\3586\6190.cmd"
1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:240

C:\Windows\system32\PING.EXE
ping 127.0.0.1
2⤵
- Runs ping.exe
PID:1164

\??\c:\users\public\my.exe
c:\\users\\public\\my.exe 3586\extinct.dat,DllRegisterServer
2⤵
- Executes dropped EXE
PID:1516

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Remote System Discovery

T1018

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Public\my.exe
Filesize
44KB

MD5
dd81d91ff3b0763c392422865c9ac12e

SHA1
963b55acc8c566876364716d5aafa353995812a8

SHA256
f5691b8f200e3196e6808e932630e862f8f26f31cd949981373f23c9d87db8b9

SHA512
8a5036ccab9c9e71deb4ecb9598528ca19c2d697a836846d23e1547b24172fa236a798092c7db676929abff830e40f52ce8f3b3bdd8d4c2553d7c021fceaf120

Download Submit
\Users\Public\my.exe
Filesize
44KB

MD5
dd81d91ff3b0763c392422865c9ac12e

SHA1
963b55acc8c566876364716d5aafa353995812a8

SHA256
f5691b8f200e3196e6808e932630e862f8f26f31cd949981373f23c9d87db8b9

SHA512
8a5036ccab9c9e71deb4ecb9598528ca19c2d697a836846d23e1547b24172fa236a798092c7db676929abff830e40f52ce8f3b3bdd8d4c2553d7c021fceaf120

Download Submit
memory/1164-54-0x0000000000000000-mapping.dmp

Download
memory/1516-56-0x0000000000000000-mapping.dmp

Download