aa3ba8802319ee0720537c03bcd0d53f52267cb85ecbf3310a8945c1d758cf9e

Analysis

max time kernel
139s
max time network
141s
platform
windows10-2004_x64
resource
win10v2004-20231215-en
resource tags

arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
submitted
30/12/2023, 07:07

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

11c07cde31eeb3b77d2837de330b4de1.exe
Size

316KB
MD5

11c07cde31eeb3b77d2837de330b4de1
SHA1

991a6b7be060f3457a23281ba45549b8ad8597d9
SHA256

aa3ba8802319ee0720537c03bcd0d53f52267cb85ecbf3310a8945c1d758cf9e
SHA512

451c4da5dfc9d4b7bab9f1338a8fdb9cce86fb518dee6e711f540f49d7afc2bbe6e5b21c335362379aa913d63075da822f7bcad42f5ac30ad64ab6819ea05941
SSDEEP

6144:FUORK1ttbV3kSobTYZGiNdniCoh+KiEWtpNjgU0Bmm19ut:FytbV3kSoXaLnToslXtpNgBBA

Score

1^/10

Malware Config

Signatures

Runs ping.exe 1 TTPs 1 IoCs

Remote System Discovery

T1018

pid	Process
4824	PING.EXE

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
2512	11c07cde31eeb3b77d2837de330b4de1.exe
2512	11c07cde31eeb3b77d2837de330b4de1.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	2512	11c07cde31eeb3b77d2837de330b4de1.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2512 wrote to memory of 536	2512	11c07cde31eeb3b77d2837de330b4de1.exe	88
PID 2512 wrote to memory of 536	2512	11c07cde31eeb3b77d2837de330b4de1.exe	88
PID 536 wrote to memory of 4824	536	cmd.exe	90
PID 536 wrote to memory of 4824	536	cmd.exe	90

C:\Users\Admin\AppData\Local\Temp\11c07cde31eeb3b77d2837de330b4de1.exe
"C:\Users\Admin\AppData\Local\Temp\11c07cde31eeb3b77d2837de330b4de1.exe"
1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2512
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /C ping 1.1.1.1 -n 1 -w 6000 > Nul & Del "C:\Users\Admin\AppData\Local\Temp\11c07cde31eeb3b77d2837de330b4de1.exe"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:536
- - C:\Windows\system32\PING.EXE
    ping 1.1.1.1 -n 1 -w 6000
    3⤵
    - Runs ping.exe
    PID:4824

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Remote System Discovery

T1018

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads