3d38835ae567b4a86bd53472104e37add45dd85a4937970ae86a0a100082ff31

Analysis

max time kernel
157s
max time network
157s
platform
windows10-2004_x64
resource
win10v2004-20231215-en
resource tags

arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
submitted
06/01/2024, 14:15

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

46704ecbc5378b50729a4075ca5d9041.exe
Size

488KB
MD5

46704ecbc5378b50729a4075ca5d9041
SHA1

48f2d69189cba0fd3c16d6c381d87e6dc96e9c12
SHA256

3d38835ae567b4a86bd53472104e37add45dd85a4937970ae86a0a100082ff31
SHA512

680b8825efe5554534abf3ae376bea6da6a417d98b16546181ad18249f754a9c8e5ae31b1955e326017568f692c1452160af9a443078d264fde8a65e0be086ab
SSDEEP

12288:FytbV3kSoXaLnToslrS4J2f4axoycGZNd1nu9:Eb5kSYaLTVlNQ4axoy5ZN3I

Score

1^/10

Malware Config

Signatures

Runs ping.exe 1 TTPs 1 IoCs

Remote System Discovery

T1018

pid	Process
3112	PING.EXE

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
3608	46704ecbc5378b50729a4075ca5d9041.exe
3608	46704ecbc5378b50729a4075ca5d9041.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	3608	46704ecbc5378b50729a4075ca5d9041.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 3608 wrote to memory of 4652	3608	46704ecbc5378b50729a4075ca5d9041.exe	90
PID 3608 wrote to memory of 4652	3608	46704ecbc5378b50729a4075ca5d9041.exe	90
PID 4652 wrote to memory of 3112	4652	cmd.exe	92
PID 4652 wrote to memory of 3112	4652	cmd.exe	92

C:\Users\Admin\AppData\Local\Temp\46704ecbc5378b50729a4075ca5d9041.exe
"C:\Users\Admin\AppData\Local\Temp\46704ecbc5378b50729a4075ca5d9041.exe"
1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3608
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /C ping 1.1.1.1 -n 1 -w 6000 > Nul & Del "C:\Users\Admin\AppData\Local\Temp\46704ecbc5378b50729a4075ca5d9041.exe"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:4652
- - C:\Windows\system32\PING.EXE
    ping 1.1.1.1 -n 1 -w 6000
    3⤵
    - Runs ping.exe
    PID:3112

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Remote System Discovery

T1018

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads