80a633c15926e0a6dc3f3c81e630482c98d9da8974a7286f2a421e3a63c1111d

Analysis

max time kernel
43s
max time network
49s
platform
windows10-2004_x64
resource
win10v2004-20220812-en
resource tags

arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
submitted
28-10-2022 21:08

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

80a633c15926e0a6dc3f3c81e630482c98d9da8974a7286f2a421e3a63c1111d.exe
Size

5.4MB
MD5

91e9402910f2c4fc5826a2eb38debae3
SHA1

ce097a3cd07a0191a27539c4ec964c0ccb78c60d
SHA256

80a633c15926e0a6dc3f3c81e630482c98d9da8974a7286f2a421e3a63c1111d
SHA512

3b62914a36911bd74bf65c5b2a6e027e75a1df994ee7c092b927a831fa5daaf1a8ff6fe522c5cf199696144e89bbc147963a2418e3a5a12e6dd8d16de300bc0d
SSDEEP

98304:n3K9cScv//PoIKHwnVA5d37Q6mjg69TBjIIj1XjEA6RTa5380CHPGWzH:n3UcNPOOVA5hQ6AX9TtHjEpRuKLvhz

Score

1^/10

Malware Config

Signatures

Runs ping.exe 1 TTPs 1 IoCs

Remote System Discovery

T1018

pid	Process
224	PING.EXE

C:\Users\Admin\AppData\Local\Temp\80a633c15926e0a6dc3f3c81e630482c98d9da8974a7286f2a421e3a63c1111d.exe
"C:\Users\Admin\AppData\Local\Temp\80a633c15926e0a6dc3f3c81e630482c98d9da8974a7286f2a421e3a63c1111d.exe"
1⤵
PID:4824
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\install.cmd" "
  2⤵
  PID:4288
- - C:\Windows\SysWOW64\msiexec.exe
    MsiExec /x {61FFA475-24D5-44FB-A51F-39B699E3D82C} /passive REBOOT=ReallySuppress
    3⤵
    PID:1632
- - C:\Windows\SysWOW64\chcp.com
    chcp 1251
    3⤵
    PID:4072
- - C:\Windows\SysWOW64\msiexec.exe
    MsiExec /x {11A90858-40BB-4858-A2DA-CA6495B5E907} /passive REBOOT=ReallySuppress
    3⤵
    PID:912
- - C:\Windows\SysWOW64\PING.EXE
    ping 127.0.0.1
    3⤵
    - Runs ping.exe
    PID:224

C:\Windows\system32\msiexec.exe
C:\Windows\system32\msiexec.exe /V
1⤵
PID:4252

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Remote System Discovery

T1018

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\install.cmd

Filesize
236B

MD5
6d782d2c99166fade652704ff59b554d

SHA1
6e43d82f0a3afc839170a4991a38d3dd9b9ecf77

SHA256
605e0fc37f7da4660da29145783c85fbac70cb9033c6f2e05deea48361760591

SHA512
016bc4783d3a1bc499e18b762ea3dc551b5669f580cf63227388b9d3b6ea79512bae3e69bb31cd20017200cef97982a7476c9cd8a54cf718cac59f1f4dd7da87

Download Submit