Analysis
-
max time kernel
93s -
max time network
120s -
platform
windows10-2004_x64 -
resource
win10v2004-20231215-en -
resource tags
arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system -
submitted
26-01-2024 09:00
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
76efb52f8d6f6d5a38695ab7a5acc4c6.exe
Resource
win7-20231215-en
windows7-x64
5 signatures
150 seconds
Behavioral task
behavioral2
Sample
76efb52f8d6f6d5a38695ab7a5acc4c6.exe
Resource
win10v2004-20231215-en
windows10-2004-x64
4 signatures
150 seconds
General
-
Target
76efb52f8d6f6d5a38695ab7a5acc4c6.exe
-
Size
528KB
-
MD5
76efb52f8d6f6d5a38695ab7a5acc4c6
-
SHA1
e3bba8a14138338e20f760e94d24d206b52cb3b5
-
SHA256
a20e3ea4cf9e0b7fa3902a61b00a7a9075debb3c31be031fa6b13161b2102c0f
-
SHA512
9dac65630e84e82dc0a16806ca992bf7398fd543f2ba93538270607d147ea03ce6e482f7075303a134d1bfb9ada9f1ee4cad0a59d271d5df5273fe80341552cf
-
SSDEEP
12288:FytbV3kSoXaLnTosla9/jBKlllzMXKaTn/7n/FmCY:Eb5kSYaLTVla97BKHlATDno
Score
1/10
Malware Config
Signatures
-
Runs ping.exe 1 TTPs 1 IoCs
pid Process 3424 PING.EXE -
Suspicious behavior: EnumeratesProcesses 2 IoCs
pid Process 3460 76efb52f8d6f6d5a38695ab7a5acc4c6.exe 3460 76efb52f8d6f6d5a38695ab7a5acc4c6.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
description pid Process Token: SeDebugPrivilege 3460 76efb52f8d6f6d5a38695ab7a5acc4c6.exe -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 3460 wrote to memory of 1132 3460 76efb52f8d6f6d5a38695ab7a5acc4c6.exe 86 PID 3460 wrote to memory of 1132 3460 76efb52f8d6f6d5a38695ab7a5acc4c6.exe 86 PID 1132 wrote to memory of 3424 1132 cmd.exe 88 PID 1132 wrote to memory of 3424 1132 cmd.exe 88
Processes
-
C:\Users\Admin\AppData\Local\Temp\76efb52f8d6f6d5a38695ab7a5acc4c6.exe"C:\Users\Admin\AppData\Local\Temp\76efb52f8d6f6d5a38695ab7a5acc4c6.exe"1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3460 -
C:\Windows\SYSTEM32\cmd.execmd.exe /C ping 1.1.1.1 -n 1 -w 6000 > Nul & Del "C:\Users\Admin\AppData\Local\Temp\76efb52f8d6f6d5a38695ab7a5acc4c6.exe"2⤵
- Suspicious use of WriteProcessMemory
PID:1132 -
C:\Windows\system32\PING.EXEping 1.1.1.1 -n 1 -w 60003⤵
- Runs ping.exe
PID:3424
-
-