fb647ae3f86cd2c3b0d2dfb83d437ba107f79c9f450def530258818212114975

Analysis

max time kernel
99s
max time network
105s
platform
windows7_x64
resource
win7-20221111-en
resource tags

arch:x64arch:x86image:win7-20221111-enlocale:en-usos:windows7-x64system
submitted
25-11-2022 06:43

Target

fb647ae3f86cd2c3b0d2dfb83d437ba107f79c9f450def530258818212114975.exe
Size

906KB
MD5

f696bf4a0a51b76e58eaeb8bf64cf300
SHA1

6ac2f53006d4e3ce5927827eebf12b8cc1287ccb
SHA256

fb647ae3f86cd2c3b0d2dfb83d437ba107f79c9f450def530258818212114975
SHA512

4b410bed2af97d40cb14f973a6514d5c9dec83f1e7c643d816266f48c34b40ba8f3c8b3e000a8189aef47a485c821ec9020ec71e14623050ce842faa6f8c2f4c
SSDEEP

12288:EHAttjAD+mZbj4DhfB45Rakvw5AGXWVrhNb9tiM2meaZEcqAOyRlgUFWtkweitIm:ElDJgn4TaZe+ur7LIan3y2W

Score

7^/10

Deletes itself 1 IoCs

Processes:

cmd.exe

pid process

560 cmd.exe
Runs ping.exe 1 TTPs 1 IoCs

Remote System Discovery
T1018

Processes:

PING.EXE

pid process

1696 PING.EXE

pid	process
560	cmd.exe

pid	process
1696	PING.EXE

Suspicious use of WriteProcessMemory 8 IoCs

Processes:

fb647ae3f86cd2c3b0d2dfb83d437ba107f79c9f450def530258818212114975.execmd.exe

description	pid	process	target process
PID 624 wrote to memory of 560	624	fb647ae3f86cd2c3b0d2dfb83d437ba107f79c9f450def530258818212114975.exe	cmd.exe
PID 624 wrote to memory of 560	624	fb647ae3f86cd2c3b0d2dfb83d437ba107f79c9f450def530258818212114975.exe	cmd.exe
PID 624 wrote to memory of 560	624	fb647ae3f86cd2c3b0d2dfb83d437ba107f79c9f450def530258818212114975.exe	cmd.exe
PID 624 wrote to memory of 560	624	fb647ae3f86cd2c3b0d2dfb83d437ba107f79c9f450def530258818212114975.exe	cmd.exe
PID 560 wrote to memory of 1696	560	cmd.exe	PING.EXE
PID 560 wrote to memory of 1696	560	cmd.exe	PING.EXE
PID 560 wrote to memory of 1696	560	cmd.exe	PING.EXE
PID 560 wrote to memory of 1696	560	cmd.exe	PING.EXE

C:\Users\Admin\AppData\Local\Temp\fb647ae3f86cd2c3b0d2dfb83d437ba107f79c9f450def530258818212114975.exe
"C:\Users\Admin\AppData\Local\Temp\fb647ae3f86cd2c3b0d2dfb83d437ba107f79c9f450def530258818212114975.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:624

C:\Windows\SysWOW64\PING.EXE
ping 1.1.1.1 -n 1 -w 3000
3⤵
- Runs ping.exe
PID:1696

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Remote System Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

memory/560-55-0x0000000000000000-mapping.dmp

Download
memory/624-54-0x00000000766F1000-0x00000000766F3000-memory.dmp

Filesize
8KB

Download
memory/1696-56-0x0000000000000000-mapping.dmp

Download