7de208f51762627de98165bce47a714e9a037af25dee590c2ffc0afbe91474fb

Analysis

max time kernel
144s
max time network
148s
platform
windows10-2004_x64
resource
win10v2004-20231222-en
resource tags

arch:x64arch:x86image:win10v2004-20231222-enlocale:en-usos:windows10-2004-x64system
submitted
03/02/2024, 21:21

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

8d605f85460038c11fb241811c137206.exe
Size

316KB
MD5

8d605f85460038c11fb241811c137206
SHA1

bf36e42b4829f5d88ab0fbe3ecd627be1406dbb1
SHA256

7de208f51762627de98165bce47a714e9a037af25dee590c2ffc0afbe91474fb
SHA512

7239bc18272bc8a25eccf151d58e3216c36641ea4ae034b6bd707537d68e50809cd1b6a107aca0fccd001aec988c71415e6c00eb51b7686756f91c1b4fe237da
SSDEEP

6144:FUORK1ttbV3kSobTYZGiNdniCoh+KiECybBnt:FytbV3kSoXaLnToslFyNt

Score

1^/10

Malware Config

Signatures

Runs ping.exe 1 TTPs 1 IoCs

Remote System Discovery

T1018

pid	Process
3268	PING.EXE

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
1688	8d605f85460038c11fb241811c137206.exe
1688	8d605f85460038c11fb241811c137206.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	1688	8d605f85460038c11fb241811c137206.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1688 wrote to memory of 4792	1688	8d605f85460038c11fb241811c137206.exe	86
PID 1688 wrote to memory of 4792	1688	8d605f85460038c11fb241811c137206.exe	86
PID 4792 wrote to memory of 3268	4792	cmd.exe	88
PID 4792 wrote to memory of 3268	4792	cmd.exe	88

C:\Users\Admin\AppData\Local\Temp\8d605f85460038c11fb241811c137206.exe
"C:\Users\Admin\AppData\Local\Temp\8d605f85460038c11fb241811c137206.exe"
1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1688
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /C ping 1.1.1.1 -n 1 -w 6000 > Nul & Del "C:\Users\Admin\AppData\Local\Temp\8d605f85460038c11fb241811c137206.exe"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:4792
- - C:\Windows\system32\PING.EXE
    ping 1.1.1.1 -n 1 -w 6000
    3⤵
    - Runs ping.exe
    PID:3268

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Remote System Discovery

T1018

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads