Analysis
-
max time kernel
149s -
max time network
151s -
platform
windows10-2004_x64 -
resource
win10v2004-20240226-en -
resource tags
arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system -
submitted
10/03/2024, 19:16
Static task
static1
Behavioral task
behavioral1
Sample
091eeb192d40a039db9d8469824fe2d986a4e13c6d57d415b1948935db207071.exe
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
091eeb192d40a039db9d8469824fe2d986a4e13c6d57d415b1948935db207071.exe
Resource
win10v2004-20240226-en
General
-
Target
091eeb192d40a039db9d8469824fe2d986a4e13c6d57d415b1948935db207071.exe
-
Size
316KB
-
MD5
2b3778321a645ae2f6b8144825789e9f
-
SHA1
e882bf56274cf0c526d194a98a473da83d631d8d
-
SHA256
091eeb192d40a039db9d8469824fe2d986a4e13c6d57d415b1948935db207071
-
SHA512
574319de110997255015fd3a228406b7b1a345ff1da84745b9ff6e02df30bacc1906fc12f1e3146a88b90e62c5b221fd301a57f756ee94cb0e4bba4c4a72a9f1
-
SSDEEP
6144:FUORK1ttbV3kSobTYZGiNdniCoh+KiE0IDJInPvxDK:FytbV3kSoXaLnToslG1InPZu
Malware Config
Signatures
-
Runs ping.exe 1 TTPs 1 IoCs
pid Process 976 PING.EXE -
Suspicious behavior: EnumeratesProcesses 2 IoCs
pid Process 4924 091eeb192d40a039db9d8469824fe2d986a4e13c6d57d415b1948935db207071.exe 4924 091eeb192d40a039db9d8469824fe2d986a4e13c6d57d415b1948935db207071.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
description pid Process Token: SeDebugPrivilege 4924 091eeb192d40a039db9d8469824fe2d986a4e13c6d57d415b1948935db207071.exe -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 4924 wrote to memory of 1644 4924 091eeb192d40a039db9d8469824fe2d986a4e13c6d57d415b1948935db207071.exe 88 PID 4924 wrote to memory of 1644 4924 091eeb192d40a039db9d8469824fe2d986a4e13c6d57d415b1948935db207071.exe 88 PID 1644 wrote to memory of 976 1644 cmd.exe 90 PID 1644 wrote to memory of 976 1644 cmd.exe 90
Processes
-
C:\Users\Admin\AppData\Local\Temp\091eeb192d40a039db9d8469824fe2d986a4e13c6d57d415b1948935db207071.exe"C:\Users\Admin\AppData\Local\Temp\091eeb192d40a039db9d8469824fe2d986a4e13c6d57d415b1948935db207071.exe"1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4924 -
C:\Windows\SYSTEM32\cmd.execmd.exe /C ping 1.1.1.1 -n 1 -w 6000 > Nul & Del "C:\Users\Admin\AppData\Local\Temp\091eeb192d40a039db9d8469824fe2d986a4e13c6d57d415b1948935db207071.exe"2⤵
- Suspicious use of WriteProcessMemory
PID:1644 -
C:\Windows\system32\PING.EXEping 1.1.1.1 -n 1 -w 60003⤵
- Runs ping.exe
PID:976
-
-