f28f389ac0824bee4f8747c853e85a78c3c8ee5f07098d49a6528ab40005abe1

Analysis

max time kernel
62s
max time network
130s
platform
windows10-2004_x64
resource
win10v2004-20220901-en
resource tags

arch:x64arch:x86image:win10v2004-20220901-enlocale:en-usos:windows10-2004-x64system
submitted
22/12/2022, 16:15

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

Sprawls.cmd
Size

398B
MD5

8be9afced6299bfb683145290a892c66
SHA1

8683bf70cb829b5a427c78987d3babbf28832564
SHA256

6023190da512fe24e7ea54a7503665e7dc6d0b138f3457e0d52a32de8f8655e4
SHA512

3c1c96e0db23d095dd2ae406cc98755fecfe478e2964fe128a0399b355bf561086d63ba4530142b57579dacf322e7f98aae8044a82d7c90286b8d9ba90841404

Score

8^/10

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
3764	synechdochism.exe

Runs ping.exe 1 TTPs 1 IoCs

Remote System Discovery

T1018

pid	Process
1568	PING.EXE

Suspicious use of WriteProcessMemory 8 IoCs

description	pid	Process	procid_target
PID 5016 wrote to memory of 544	5016	cmd.exe	82
PID 5016 wrote to memory of 544	5016	cmd.exe	82
PID 5016 wrote to memory of 3032	5016	cmd.exe	83
PID 5016 wrote to memory of 3032	5016	cmd.exe	83
PID 5016 wrote to memory of 3764	5016	cmd.exe	84
PID 5016 wrote to memory of 3764	5016	cmd.exe	84
PID 5016 wrote to memory of 1568	5016	cmd.exe	85
PID 5016 wrote to memory of 1568	5016	cmd.exe	85

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\Sprawls.cmd"
1⤵
- Suspicious use of WriteProcessMemory
PID:5016
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /S /D /c" echo f"
  2⤵
  PID:544
- C:\Windows\system32\xcopy.exe
  xcopy C:\Windows\\\\\\system32\\\\\\wscript.exe C:\Users\Admin\AppData\Local\Temp\synechdochism.exe /h /s /e
  2⤵
  PID:3032
- C:\Users\Admin\AppData\Local\Temp\synechdochism.exe
  C:\Users\Admin\AppData\Local\Temp\synechdochism.exe UnprepossessedRockeries\Outscout\OvervehemenceSeparatrices\CoffeaReaspire.wsf
  2⤵
  - Executes dropped EXE
  PID:3764
- C:\Windows\system32\PING.EXE
  ping 87.31.194.42
  2⤵
  - Runs ping.exe
  PID:1568

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Remote System Discovery

T1018

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\synechdochism.exe

Filesize
166KB

MD5
a47cbe969ea935bdd3ab568bb126bc80

SHA1
15f2facfd05daf46d2c63912916bf2887cebd98a

SHA256
34008e2057df8842df210246995385a0441dc1e081d60ad15bd481e062e7f100

SHA512
f5c81e6dc4d916944304fc85136e1ff6dee29a21e50a54fe6280a475343eccbfe094171d62475db5f38e07898c061126158c34d48b9d8f4f57f76d49e564e3fc

Download Submit
C:\Users\Admin\AppData\Local\Temp\synechdochism.exe

Filesize
166KB

MD5
a47cbe969ea935bdd3ab568bb126bc80

SHA1
15f2facfd05daf46d2c63912916bf2887cebd98a

SHA256
34008e2057df8842df210246995385a0441dc1e081d60ad15bd481e062e7f100

SHA512
f5c81e6dc4d916944304fc85136e1ff6dee29a21e50a54fe6280a475343eccbfe094171d62475db5f38e07898c061126158c34d48b9d8f4f57f76d49e564e3fc

Download Submit