f28f389ac0824bee4f8747c853e85a78c3c8ee5f07098d49a6528ab40005abe1

Analysis

max time kernel
30s
max time network
33s
platform
windows7_x64
resource
win7-20221111-en
resource tags

arch:x64arch:x86image:win7-20221111-enlocale:en-usos:windows7-x64system
submitted
22-12-2022 16:15

Target

semihonorSpeculated/CommercerMisbestowing.cmd
Size

389B
MD5

06e4d5e35a83ff4bdaf77d1c9f5edee5
SHA1

2d0e88c63d2845d0e742712f93b12fd77243aea9
SHA256

ccc2cf6bb99190a931cc1d9481a996ae153d41c3375547e2c97adcad3fd98194
SHA512

76cefe433d8d258072660ba874cb4fce3ae3e04e27ccde9888ae2f75f356394af01bd4269abd48dbfdaa9125bc80c2a96b08c431b6fcd12da2992539dd34b8fb

Score

1^/10

Runs ping.exe 1 TTPs 1 IoCs

Remote System Discovery

pid	Process
576	PING.EXE

Suspicious use of WriteProcessMemory 9 IoCs

description	pid	Process	procid_target
PID 2012 wrote to memory of 1876	2012	cmd.exe	29
PID 2012 wrote to memory of 1876	2012	cmd.exe	29
PID 2012 wrote to memory of 1876	2012	cmd.exe	29
PID 2012 wrote to memory of 1664	2012	cmd.exe	30
PID 2012 wrote to memory of 1664	2012	cmd.exe	30
PID 2012 wrote to memory of 1664	2012	cmd.exe	30
PID 2012 wrote to memory of 576	2012	cmd.exe	31
PID 2012 wrote to memory of 576	2012	cmd.exe	31
PID 2012 wrote to memory of 576	2012	cmd.exe	31

C:\Windows\system32\cmd.exe
cmd /c "C:\Users\Admin\AppData\Local\Temp\semihonorSpeculated\CommercerMisbestowing.cmd"
1⤵
- Suspicious use of WriteProcessMemory
PID:2012
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /S /D /c" echo f"
  2⤵
  PID:1876
- C:\Windows\system32\xcopy.exe
  xcopy C:\Windows\\\\\\system32\\\\\\rundll32.exe C:\Users\Admin\AppData\Local\Temp\gibbetting.exe /h /s /e
  2⤵
  PID:1664
- C:\Windows\system32\PING.EXE
  ping 192.111.73.123
  2⤵
  - Runs ping.exe
  PID:576

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Remote System Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact