621ff733aa50c737ad9ab27dbb74859510882bea4d3df735039a5c90835eec55

Analysis

max time kernel
143s
max time network
152s
platform
windows10-2004_x64
resource
win10v2004-20231215-en
resource tags

arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
submitted
25-01-2024 06:30

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

73f8de1b995296c4e06ba3ff620f9ab3.exe
Size

488KB
MD5

73f8de1b995296c4e06ba3ff620f9ab3
SHA1

07e7ced47b11903aaa3ca8626cc404abcf90fc80
SHA256

621ff733aa50c737ad9ab27dbb74859510882bea4d3df735039a5c90835eec55
SHA512

a9ebe68271d9560396ed76a0b212a4a2ac3274f03ad297ea42d412c6aabe537cc7b43d9ff83a81898d5ac0ca69ef5a2ea9027cee3abf5fe32467ab2d0946e82d
SSDEEP

12288:FytbV3kSoXaLnToslC2EFmMRgMq515M/8+Wo/Nue:Eb5kSYaLTVlCd7uoNue

Score

1^/10

Malware Config

Signatures

Runs ping.exe 1 TTPs 1 IoCs

Remote System Discovery

T1018

pid	Process
1652	PING.EXE

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
4528	73f8de1b995296c4e06ba3ff620f9ab3.exe
4528	73f8de1b995296c4e06ba3ff620f9ab3.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	4528	73f8de1b995296c4e06ba3ff620f9ab3.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 4528 wrote to memory of 5056	4528	73f8de1b995296c4e06ba3ff620f9ab3.exe	23
PID 4528 wrote to memory of 5056	4528	73f8de1b995296c4e06ba3ff620f9ab3.exe	23
PID 5056 wrote to memory of 1652	5056	cmd.exe	24
PID 5056 wrote to memory of 1652	5056	cmd.exe	24

C:\Users\Admin\AppData\Local\Temp\73f8de1b995296c4e06ba3ff620f9ab3.exe
"C:\Users\Admin\AppData\Local\Temp\73f8de1b995296c4e06ba3ff620f9ab3.exe"
1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4528
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /C ping 1.1.1.1 -n 1 -w 6000 > Nul & Del "C:\Users\Admin\AppData\Local\Temp\73f8de1b995296c4e06ba3ff620f9ab3.exe"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:5056
- - C:\Windows\system32\PING.EXE
    ping 1.1.1.1 -n 1 -w 6000
    3⤵
    - Runs ping.exe
    PID:1652

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Remote System Discovery

T1018

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads