e35abc4a7ec35bb886aeb68958c71832232d8c58610f34c5265f143fb7841bcb

Analysis

max time kernel
179s
max time network
201s
platform
windows10-2004_x64
resource
win10v2004-20221111-en
resource tags

arch:x64arch:x86image:win10v2004-20221111-enlocale:en-usos:windows10-2004-x64system
submitted
05/12/2022, 06:47

Target

rick.bat
Size

32B
MD5

2b547e0d5a071080e6210b38a3cf561b
SHA1

f0c98f136423e54690f0de956f141bc6974d6d72
SHA256

e35abc4a7ec35bb886aeb68958c71832232d8c58610f34c5265f143fb7841bcb
SHA512

e49fdd73b127f723c7d0163b4cf8b5551e0e8fa4ee2986fdf336a4a695d469b4c1797517823b84c2cf1173360b716da8fed870af4bdbbd18ce29b5c60b6f4175

Score

1^/10

Runs ping.exe 1 TTPs 1 IoCs

Remote System Discovery

pid	Process
4188	PING.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 3704 wrote to memory of 4796	3704	cmd.exe	83
PID 3704 wrote to memory of 4796	3704	cmd.exe	83
PID 4796 wrote to memory of 4188	4796	cmd.exe	84
PID 4796 wrote to memory of 4188	4796	cmd.exe	84

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\rick.bat"
1⤵
- Suspicious use of WriteProcessMemory
PID:3704
- C:\Windows\system32\cmd.exe
  cmd.exe /c ping 192.168.119.247
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:4796
- - C:\Windows\system32\PING.EXE
    ping 192.168.119.247
    3⤵
    - Runs ping.exe
    PID:4188

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Remote System Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact