814299de88cde77b7f06476f2abf8f6719d3b8d2184796114c56a6ee08833e61

Analysis

max time kernel
65s
max time network
141s
platform
windows10-2004_x64
resource
win10v2004-20220812-en
resource tags

arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
submitted
06-10-2022 17:49

Target

3586/6190.cmd
Size

187B
MD5

5f1a86f574068771662310dd27e4dda8
SHA1

f94bcb88b0ea66b537b509de72340c1288cbe12b
SHA256

7d5bdd81da74a8908216ef80642588eec11009c06decfa86aa9ef321aa1ca854
SHA512

931392aa68db4ea9c9d58c32b5cfd087dc93f2e7a179b8f8ba05bea6ab028ec1afe09af8a9e10f0d65be9df9cdf54814d18a2d6d173057e12baa79b25e2e9538

Score

8^/10

Executes dropped EXE 1 IoCs

Processes:

my.exe

pid process

1676 my.exe
Runs ping.exe 1 TTPs 1 IoCs

Remote System Discovery
T1018

Processes:

PING.EXE

pid process

4244 PING.EXE

pid	process
1676	my.exe

pid	process
4244	PING.EXE

Suspicious use of WriteProcessMemory 4 IoCs

Processes:

cmd.exe

description	pid	process	target process
PID 804 wrote to memory of 4244	804	cmd.exe	PING.EXE
PID 804 wrote to memory of 4244	804	cmd.exe	PING.EXE
PID 804 wrote to memory of 1676	804	cmd.exe	my.exe
PID 804 wrote to memory of 1676	804	cmd.exe	my.exe

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\3586\6190.cmd"
1⤵
- Suspicious use of WriteProcessMemory
PID:804

\??\c:\users\public\my.exe
c:\\users\\public\\my.exe 3586\extinct.dat,DllRegisterServer
2⤵
- Executes dropped EXE
PID:1676

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Remote System Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

C:\Users\Public\my.exe

Filesize
70KB

MD5
ef3179d498793bf4234f708d3be28633

SHA1
dd399ae46303343f9f0da189aee11c67bd868222

SHA256
b53f3c0cd32d7f20849850768da6431e5f876b7bfa61db0aa0700b02873393fa

SHA512
02aff154762d7e53e37754f878ce6aa3f4df5a1eb167e27f13d9762dced32bec892bfa3f3314e3c6dce5998f7d3c400d7d0314b9326eedcab72207c60b3d332e

Download Submit
memory/1676-133-0x0000000000000000-mapping.dmp

Download
memory/4244-132-0x0000000000000000-mapping.dmp

Download