441116d55e97124a067207bf57483dd3462bccfb034e56c4152675b0dcb118e7

Analysis

max time kernel
120s
max time network
121s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
16-03-2024 15:13

Target

712affaa8b84e8fb7d4e71feb6c1074185bc43b5a2f265fbfb248f7ed40a5489 (1).exe
Size

1.7MB
MD5

1c526b6bd496e217833972f77a235928
SHA1

49dde9bf9e2f11abf13dc55cbf901af49e575bc1
SHA256

712affaa8b84e8fb7d4e71feb6c1074185bc43b5a2f265fbfb248f7ed40a5489
SHA512

884b01546adc3c64ec04cc5856fdd7ce5f851dea2eb4066ea398dfeb62a23eab14a592e7be4f286625cd94b3c8b6254d3646eb05ddf0d6a70aa160e7e2cba2a8
SSDEEP

24576:lTnv8YkXw+xfggJJmlm5SJPC/QMyKesckckSZahVY06uIxf+ubfOLVU:J0Husckc4Y0/IACmL2

Score

1^/10

Runs ping.exe 1 TTPs 1 IoCs

Remote System Discovery
T1018

Processes:

PING.EXE

pid process

2536 PING.EXE

pid	process
2536	PING.EXE

Suspicious use of WriteProcessMemory 8 IoCs

Processes:

712affaa8b84e8fb7d4e71feb6c1074185bc43b5a2f265fbfb248f7ed40a5489 (1).execmd.exe

description	pid	process	target process
PID 2040 wrote to memory of 2572	2040	712affaa8b84e8fb7d4e71feb6c1074185bc43b5a2f265fbfb248f7ed40a5489 (1).exe	cmd.exe
PID 2040 wrote to memory of 2572	2040	712affaa8b84e8fb7d4e71feb6c1074185bc43b5a2f265fbfb248f7ed40a5489 (1).exe	cmd.exe
PID 2040 wrote to memory of 2572	2040	712affaa8b84e8fb7d4e71feb6c1074185bc43b5a2f265fbfb248f7ed40a5489 (1).exe	cmd.exe
PID 2040 wrote to memory of 2572	2040	712affaa8b84e8fb7d4e71feb6c1074185bc43b5a2f265fbfb248f7ed40a5489 (1).exe	cmd.exe
PID 2572 wrote to memory of 2536	2572	cmd.exe	PING.EXE
PID 2572 wrote to memory of 2536	2572	cmd.exe	PING.EXE
PID 2572 wrote to memory of 2536	2572	cmd.exe	PING.EXE
PID 2572 wrote to memory of 2536	2572	cmd.exe	PING.EXE

C:\Users\Admin\AppData\Local\Temp\712affaa8b84e8fb7d4e71feb6c1074185bc43b5a2f265fbfb248f7ed40a5489 (1).exe
"C:\Users\Admin\AppData\Local\Temp\712affaa8b84e8fb7d4e71feb6c1074185bc43b5a2f265fbfb248f7ed40a5489 (1).exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2040

C:\Windows\SysWOW64\cmd.exe
cmd /K ping 1.1.1.1 -n 1 -w 3000 > Nul & Del 712affaa8b84e8fb7d4e71feb6c1074185bc43b5a2f265fbfb248f7ed40a5489 (1).exe
2⤵
- Suspicious use of WriteProcessMemory
PID:2572

C:\Windows\SysWOW64\PING.EXE
ping 1.1.1.1 -n 1 -w 3000
3⤵
- Runs ping.exe
PID:2536

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Remote System Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

memory/2040-0-0x0000000000400000-0x00000000005BE000-memory.dmp

Filesize
1.7MB

Download
memory/2040-2-0x0000000000400000-0x00000000005BE000-memory.dmp

Filesize
1.7MB

Download