Analysis
-
max time kernel
147s -
max time network
151s -
platform
windows10-2004_x64 -
resource
win10v2004-20231215-en -
resource tags
arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system -
submitted
30-12-2023 06:09
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
10ba2a053cc1b299102bdea13d12dc9d.exe
Resource
win7-20231215-en
windows7-x64
5 signatures
150 seconds
Behavioral task
behavioral2
Sample
10ba2a053cc1b299102bdea13d12dc9d.exe
Resource
win10v2004-20231215-en
windows10-2004-x64
4 signatures
150 seconds
General
-
Target
10ba2a053cc1b299102bdea13d12dc9d.exe
-
Size
488KB
-
MD5
10ba2a053cc1b299102bdea13d12dc9d
-
SHA1
8045068eb9b4d7794b614a8b1efe4a03741349d2
-
SHA256
a2c8b0fd8e5547e93c5043b5492eeb962d0456dc59115cf32a0f7a1e0022d5fc
-
SHA512
58410c0b72391327ba2e3f90fe9ae8e838f7a84c7b0f1119fe648a96a947d758d5258c6af50d5d3e1e6b326c1ac8e5110a685258435ca4265144c197a50c582b
-
SSDEEP
12288:FytbV3kSoXaLnToslEiB6VJJzYyaqVRUmEHyO+L:Eb5kSYaLTVlV67JnaCUmyyJ
Score
1/10
Malware Config
Signatures
-
Runs ping.exe 1 TTPs 1 IoCs
pid Process 4588 PING.EXE -
Suspicious behavior: EnumeratesProcesses 2 IoCs
pid Process 880 10ba2a053cc1b299102bdea13d12dc9d.exe 880 10ba2a053cc1b299102bdea13d12dc9d.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
description pid Process Token: SeDebugPrivilege 880 10ba2a053cc1b299102bdea13d12dc9d.exe -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 880 wrote to memory of 3584 880 10ba2a053cc1b299102bdea13d12dc9d.exe 20 PID 880 wrote to memory of 3584 880 10ba2a053cc1b299102bdea13d12dc9d.exe 20 PID 3584 wrote to memory of 4588 3584 cmd.exe 15 PID 3584 wrote to memory of 4588 3584 cmd.exe 15
Processes
-
C:\Users\Admin\AppData\Local\Temp\10ba2a053cc1b299102bdea13d12dc9d.exe"C:\Users\Admin\AppData\Local\Temp\10ba2a053cc1b299102bdea13d12dc9d.exe"1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:880 -
C:\Windows\SYSTEM32\cmd.execmd.exe /C ping 1.1.1.1 -n 1 -w 6000 > Nul & Del "C:\Users\Admin\AppData\Local\Temp\10ba2a053cc1b299102bdea13d12dc9d.exe"2⤵
- Suspicious use of WriteProcessMemory
PID:3584
-
-
C:\Windows\system32\PING.EXEping 1.1.1.1 -n 1 -w 60001⤵
- Runs ping.exe
PID:4588