8113812f15d7c47e7fe4408f8cca5154f42c4e38ca9a88cc4fd4190915c813f6

Analysis

max time kernel
136s
max time network
157s
platform
windows10-2004_x64
resource
win10v2004-20220812-en
resource tags

arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
submitted
23-11-2022 13:51

Target

8113812f15d7c47e7fe4408f8cca5154f42c4e38ca9a88cc4fd4190915c813f6.exe
Size

414KB
MD5

54a8ba95f43b97952d06c8213169bd8c
SHA1

b63db415ac40c5a7122ff190044062e0cc9ec078
SHA256

8113812f15d7c47e7fe4408f8cca5154f42c4e38ca9a88cc4fd4190915c813f6
SHA512

1d289088535a87495e998ad2a8c997938c1bf09e141dabe3d64f429cdac0d0558e1b28deeb35c627e89faed1f3c60894ee0824034297e78fade49500bc766705
SSDEEP

6144:rgrtzi+hNe6C2afXdiVmmK2NoXEmtho30nuQdIrJ95Z3y5Szg:rKtl/UhfXdiVQ2SENkntdIrJ95Z3

Score

1^/10

Runs ping.exe 1 TTPs 1 IoCs

Remote System Discovery
T1018

Processes:

PING.EXE

pid process

560 PING.EXE

pid	process
560	PING.EXE

Suspicious use of WriteProcessMemory 6 IoCs

Processes:

8113812f15d7c47e7fe4408f8cca5154f42c4e38ca9a88cc4fd4190915c813f6.execmd.exe

description	pid	process	target process
PID 1676 wrote to memory of 4728	1676	8113812f15d7c47e7fe4408f8cca5154f42c4e38ca9a88cc4fd4190915c813f6.exe	cmd.exe
PID 1676 wrote to memory of 4728	1676	8113812f15d7c47e7fe4408f8cca5154f42c4e38ca9a88cc4fd4190915c813f6.exe	cmd.exe
PID 1676 wrote to memory of 4728	1676	8113812f15d7c47e7fe4408f8cca5154f42c4e38ca9a88cc4fd4190915c813f6.exe	cmd.exe
PID 4728 wrote to memory of 560	4728	cmd.exe	PING.EXE
PID 4728 wrote to memory of 560	4728	cmd.exe	PING.EXE
PID 4728 wrote to memory of 560	4728	cmd.exe	PING.EXE

C:\Users\Admin\AppData\Local\Temp\8113812f15d7c47e7fe4408f8cca5154f42c4e38ca9a88cc4fd4190915c813f6.exe
"C:\Users\Admin\AppData\Local\Temp\8113812f15d7c47e7fe4408f8cca5154f42c4e38ca9a88cc4fd4190915c813f6.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1676

C:\Windows\SysWOW64\cmd.exe
cmd.exe /C ping 1.1.1.1 -n 1 -w 3000 > Nul & Del "C:\Users\Admin\AppData\Local\Temp\8113812f15d7c47e7fe4408f8cca5154f42c4e38ca9a88cc4fd4190915c813f6.exe"
2⤵
- Suspicious use of WriteProcessMemory
PID:4728

C:\Windows\SysWOW64\PING.EXE
ping 1.1.1.1 -n 1 -w 3000
3⤵
- Runs ping.exe
PID:560

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Remote System Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact