f8e612a51949ed91306bf1bb26067f76a9755e7045ae4c7b052dedbdb7704418

Analysis

max time kernel
90s
max time network
149s
platform
windows10-2004_x64
resource
win10v2004-20231222-en
resource tags

arch:x64arch:x86image:win10v2004-20231222-enlocale:en-usos:windows10-2004-x64system
submitted
01/02/2024, 02:15

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

82a17c7d760cafb7f34c0672e53441ef.exe
Size

2.2MB
MD5

82a17c7d760cafb7f34c0672e53441ef
SHA1

d793914f1a3cdedbec9e0e8d9d9837bfc88b4ee0
SHA256

f8e612a51949ed91306bf1bb26067f76a9755e7045ae4c7b052dedbdb7704418
SHA512

82258717ac5fb9428ae5cd9b54a948c05e110aca5083cf3a1c6db256ae7bc9126384d30bcbba754b09183ec44cc8697fa5ebf761a5f372204f9ed485b8c5dbe7
SSDEEP

49152:Eb5k2L5/+ToUiSswkr+Cu+4r7skhdpXRGAaVkLnJD8txFxWPGVL:Eydm+TrokjZsAaVkLncUOl

Score

1^/10

Malware Config

Signatures

Runs ping.exe 1 TTPs 1 IoCs

Remote System Discovery

T1018

pid	Process
3888	PING.EXE

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
1176	82a17c7d760cafb7f34c0672e53441ef.exe
1176	82a17c7d760cafb7f34c0672e53441ef.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	1176	82a17c7d760cafb7f34c0672e53441ef.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1176 wrote to memory of 2576	1176	82a17c7d760cafb7f34c0672e53441ef.exe	86
PID 1176 wrote to memory of 2576	1176	82a17c7d760cafb7f34c0672e53441ef.exe	86
PID 2576 wrote to memory of 3888	2576	cmd.exe	88
PID 2576 wrote to memory of 3888	2576	cmd.exe	88

C:\Users\Admin\AppData\Local\Temp\82a17c7d760cafb7f34c0672e53441ef.exe
"C:\Users\Admin\AppData\Local\Temp\82a17c7d760cafb7f34c0672e53441ef.exe"
1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1176
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /C ping 1.1.1.1 -n 1 -w 6000 > Nul & Del "C:\Users\Admin\AppData\Local\Temp\82a17c7d760cafb7f34c0672e53441ef.exe"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2576
- - C:\Windows\system32\PING.EXE
    ping 1.1.1.1 -n 1 -w 6000
    3⤵
    - Runs ping.exe
    PID:3888

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Remote System Discovery

T1018

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads