d19c807b52f1c91053e96383d7650e414979cbd80b06442ccf04d5f458cb7b32

Analysis

max time kernel
91s
max time network
149s
platform
windows10-2004_x64
resource
win10v2004-20231222-en
resource tags

arch:x64arch:x86image:win10v2004-20231222-enlocale:en-usos:windows10-2004-x64system
submitted
01-02-2024 23:30

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

87f2f0255fd54659b55a75a8d21f1b65.exe
Size

5.1MB
MD5

87f2f0255fd54659b55a75a8d21f1b65
SHA1

5b21f4bfdc79b7a5281256185d07507ea69136a1
SHA256

d19c807b52f1c91053e96383d7650e414979cbd80b06442ccf04d5f458cb7b32
SHA512

176586411e3a88a93a855cdebef9b00454c2d83490e24b4ac72be9c50d1814278b8ced4fc808c3c63e86e7fa6108eacd52e49c08268a56122febc1ec0ca2fafc
SSDEEP

98304:Eq6CmbuenbWxJ5Eq+2hvjB9uw80xiAlYybmFpGtFohq5Sjwc0b:EqbmbAxof2pz8YDlKpGtUHjwcE

Score

1^/10

Malware Config

Signatures

Runs ping.exe 1 TTPs 1 IoCs

Remote System Discovery

T1018

pid	Process
2884	PING.EXE

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
2276	87f2f0255fd54659b55a75a8d21f1b65.exe
2276	87f2f0255fd54659b55a75a8d21f1b65.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	2276	87f2f0255fd54659b55a75a8d21f1b65.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2276 wrote to memory of 4008	2276	87f2f0255fd54659b55a75a8d21f1b65.exe	30
PID 2276 wrote to memory of 4008	2276	87f2f0255fd54659b55a75a8d21f1b65.exe	30
PID 4008 wrote to memory of 2884	4008	cmd.exe	29
PID 4008 wrote to memory of 2884	4008	cmd.exe	29

C:\Users\Admin\AppData\Local\Temp\87f2f0255fd54659b55a75a8d21f1b65.exe
"C:\Users\Admin\AppData\Local\Temp\87f2f0255fd54659b55a75a8d21f1b65.exe"
1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2276
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /C ping 1.1.1.1 -n 1 -w 6000 > Nul & Del "C:\Users\Admin\AppData\Local\Temp\87f2f0255fd54659b55a75a8d21f1b65.exe"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:4008

C:\Windows\system32\PING.EXE
ping 1.1.1.1 -n 1 -w 6000
1⤵
- Runs ping.exe
PID:2884

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Remote System Discovery

T1018

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads