e88f0a9e1272d10237ae373145439cbe7427ad8fd00d838670fc2279f62fab8c

Analysis

max time kernel
171s
max time network
175s
platform
windows10-2004_x64
resource
win10v2004-20220812-en
resource tags

arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
submitted
25-11-2022 06:52

Target

e88f0a9e1272d10237ae373145439cbe7427ad8fd00d838670fc2279f62fab8c.exe
Size

906KB
MD5

00de0081180f60da2cc5bdd68bc50a47
SHA1

3a5f8a75ef35c03e5b89add8c854167b850e61c6
SHA256

e88f0a9e1272d10237ae373145439cbe7427ad8fd00d838670fc2279f62fab8c
SHA512

5cb1dee91285cff4b8132a5c1e7f3d1221ec74e35a59d86b0f9a5e6c41ca419e24da3698fda2528e779f64e8622d20fc47f08c888eb31245537ca1f573949730
SSDEEP

12288:EHAttjAD+mZbj4DhfB45Rakvw5AGXWVrhNb9tiM2meaZEcqAOyRlgVFWtkweitIm:ElDJgn4TaZe+ur7LIanUy2W

Score

1^/10

Runs ping.exe 1 TTPs 1 IoCs

Remote System Discovery
T1018

Processes:

PING.EXE

pid process

4660 PING.EXE

pid	process
4660	PING.EXE

Suspicious use of WriteProcessMemory 6 IoCs

Processes:

e88f0a9e1272d10237ae373145439cbe7427ad8fd00d838670fc2279f62fab8c.execmd.exe

description	pid	process	target process
PID 2172 wrote to memory of 4740	2172	e88f0a9e1272d10237ae373145439cbe7427ad8fd00d838670fc2279f62fab8c.exe	cmd.exe
PID 2172 wrote to memory of 4740	2172	e88f0a9e1272d10237ae373145439cbe7427ad8fd00d838670fc2279f62fab8c.exe	cmd.exe
PID 2172 wrote to memory of 4740	2172	e88f0a9e1272d10237ae373145439cbe7427ad8fd00d838670fc2279f62fab8c.exe	cmd.exe
PID 4740 wrote to memory of 4660	4740	cmd.exe	PING.EXE
PID 4740 wrote to memory of 4660	4740	cmd.exe	PING.EXE
PID 4740 wrote to memory of 4660	4740	cmd.exe	PING.EXE

C:\Users\Admin\AppData\Local\Temp\e88f0a9e1272d10237ae373145439cbe7427ad8fd00d838670fc2279f62fab8c.exe
"C:\Users\Admin\AppData\Local\Temp\e88f0a9e1272d10237ae373145439cbe7427ad8fd00d838670fc2279f62fab8c.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2172

C:\Windows\SysWOW64\cmd.exe
cmd.exe /C ping 1.1.1.1 -n 1 -w 3000 > Nul & Del "C:\Users\Admin\AppData\Local\Temp\e88f0a9e1272d10237ae373145439cbe7427ad8fd00d838670fc2279f62fab8c.exe"
2⤵
- Suspicious use of WriteProcessMemory
PID:4740

C:\Windows\SysWOW64\PING.EXE
ping 1.1.1.1 -n 1 -w 3000
3⤵
- Runs ping.exe
PID:4660

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Remote System Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact