405f58cce56e091ebc4b28c470708bb50af13ee11ab752925f28b68e9254736d

Analysis

max time kernel
117s
max time network
120s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
11/03/2024, 18:09

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

c142d28c4763b8e73689da7fd71927a0.exe
Size

488KB
MD5

c142d28c4763b8e73689da7fd71927a0
SHA1

9c1f4c70de312d5187ea74e5d5fc2649c9ae0e2a
SHA256

405f58cce56e091ebc4b28c470708bb50af13ee11ab752925f28b68e9254736d
SHA512

154cb5125fc235cf294c8cc98da3808cdb6c9c3cb2f74acab44b322ea9ebbfe834864e3875a4bec1fdbafbb4c7edfe09f837aeeaa6f9719c9144fdebf111d0a8
SSDEEP

6144:FUORK1ttbV3kSobTYZGiNdniCoh+KiEvZ7/uCYL7fc+BVqxdE30wKznF/zdHOIOc:FytbV3kSoXaLnToslEF/uLKQk7zFr5rF

Score

7^/10

Malware Config

Signatures

Deletes itself 1 IoCs

pid	Process
2584	cmd.exe

Runs ping.exe 1 TTPs 1 IoCs

Remote System Discovery

T1018

pid	Process
1084	PING.EXE

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
2208	c142d28c4763b8e73689da7fd71927a0.exe
2208	c142d28c4763b8e73689da7fd71927a0.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	2208	c142d28c4763b8e73689da7fd71927a0.exe

Suspicious use of WriteProcessMemory 6 IoCs

description	pid	Process	procid_target
PID 2208 wrote to memory of 2584	2208	c142d28c4763b8e73689da7fd71927a0.exe	28
PID 2208 wrote to memory of 2584	2208	c142d28c4763b8e73689da7fd71927a0.exe	28
PID 2208 wrote to memory of 2584	2208	c142d28c4763b8e73689da7fd71927a0.exe	28
PID 2584 wrote to memory of 1084	2584	cmd.exe	30
PID 2584 wrote to memory of 1084	2584	cmd.exe	30
PID 2584 wrote to memory of 1084	2584	cmd.exe	30

C:\Users\Admin\AppData\Local\Temp\c142d28c4763b8e73689da7fd71927a0.exe
"C:\Users\Admin\AppData\Local\Temp\c142d28c4763b8e73689da7fd71927a0.exe"
1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2208
- C:\Windows\system32\cmd.exe
  cmd.exe /C ping 1.1.1.1 -n 1 -w 6000 > Nul & Del "C:\Users\Admin\AppData\Local\Temp\c142d28c4763b8e73689da7fd71927a0.exe"
  2⤵
  - Deletes itself
  - Suspicious use of WriteProcessMemory
  PID:2584
- - C:\Windows\system32\PING.EXE
    ping 1.1.1.1 -n 1 -w 6000
    3⤵
    - Runs ping.exe
    PID:1084

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Remote System Discovery

T1018

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads