Analysis
-
max time kernel
155s -
max time network
157s -
platform
windows10-2004_x64 -
resource
win10v2004-20240226-en -
resource tags
arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system -
submitted
05/03/2024, 17:33
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
b5438effcdc01f6be0dc1417cc55823c.exe
Resource
win7-20240221-en
5 signatures
150 seconds
Behavioral task
behavioral2
Sample
b5438effcdc01f6be0dc1417cc55823c.exe
Resource
win10v2004-20240226-en
4 signatures
150 seconds
General
-
Target
b5438effcdc01f6be0dc1417cc55823c.exe
-
Size
316KB
-
MD5
b5438effcdc01f6be0dc1417cc55823c
-
SHA1
580303acb134dba106e43eab33603e5c30e7def2
-
SHA256
3acc516d1ca0a4dfed774538524625fe34d04658c9cccafa23ce9316e0a63827
-
SHA512
34d0e479e0c1aac19f21e7feda34e3f7b187a942b3d713d4a219511efa6a5b6b992ed0254d71ef0bf336753270294794c60dcb5b8a9452201b3565a69b907f3b
-
SSDEEP
6144:FUORK1ttbV3kSobTYZGiNdniCoh+KiEHS/h0Y4tOATX:FytbV3kSoXaLnToslSS/N4/TX
Score
1/10
Malware Config
Signatures
-
Runs ping.exe 1 TTPs 1 IoCs
pid Process 3360 PING.EXE -
Suspicious behavior: EnumeratesProcesses 2 IoCs
pid Process 2528 b5438effcdc01f6be0dc1417cc55823c.exe 2528 b5438effcdc01f6be0dc1417cc55823c.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
description pid Process Token: SeDebugPrivilege 2528 b5438effcdc01f6be0dc1417cc55823c.exe -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 2528 wrote to memory of 3704 2528 b5438effcdc01f6be0dc1417cc55823c.exe 87 PID 2528 wrote to memory of 3704 2528 b5438effcdc01f6be0dc1417cc55823c.exe 87 PID 3704 wrote to memory of 3360 3704 cmd.exe 89 PID 3704 wrote to memory of 3360 3704 cmd.exe 89
Processes
-
C:\Users\Admin\AppData\Local\Temp\b5438effcdc01f6be0dc1417cc55823c.exe"C:\Users\Admin\AppData\Local\Temp\b5438effcdc01f6be0dc1417cc55823c.exe"1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2528 -
C:\Windows\SYSTEM32\cmd.execmd.exe /C ping 1.1.1.1 -n 1 -w 6000 > Nul & Del "C:\Users\Admin\AppData\Local\Temp\b5438effcdc01f6be0dc1417cc55823c.exe"2⤵
- Suspicious use of WriteProcessMemory
PID:3704 -
C:\Windows\system32\PING.EXEping 1.1.1.1 -n 1 -w 60003⤵
- Runs ping.exe
PID:3360
-
-