7185e8c694984f512a44f240e4b89647c759ba756bd9e9947414941e4342d466

Analysis

max time kernel
1565s
max time network
1567s
platform
windows7_x64
resource
win7-20240705-en
resource tags

arch:x64arch:x86image:win7-20240705-enlocale:en-usos:windows7-x64system
submitted
17-07-2024 19:21

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

712affaa8b84e8fb7d4e71feb6c1074185bc43b5a2f265fbfb248f7ed40a5489 (1).exe
Size

1.7MB
MD5

1c526b6bd496e217833972f77a235928
SHA1

49dde9bf9e2f11abf13dc55cbf901af49e575bc1
SHA256

712affaa8b84e8fb7d4e71feb6c1074185bc43b5a2f265fbfb248f7ed40a5489
SHA512

884b01546adc3c64ec04cc5856fdd7ce5f851dea2eb4066ea398dfeb62a23eab14a592e7be4f286625cd94b3c8b6254d3646eb05ddf0d6a70aa160e7e2cba2a8
SSDEEP

24576:lTnv8YkXw+xfggJJmlm5SJPC/QMyKesckckSZahVY06uIxf+ubfOLVU:J0Husckc4Y0/IACmL2

Score

1^/10

Malware Config

Signatures

Runs ping.exe 1 TTPs 1 IoCs

Remote System Discovery

T1018

pid	Process
2724	PING.EXE

Suspicious use of WriteProcessMemory 8 IoCs

description	pid	Process	procid_target
PID 2760 wrote to memory of 2908	2760	712affaa8b84e8fb7d4e71feb6c1074185bc43b5a2f265fbfb248f7ed40a5489 (1).exe	32
PID 2760 wrote to memory of 2908	2760	712affaa8b84e8fb7d4e71feb6c1074185bc43b5a2f265fbfb248f7ed40a5489 (1).exe	32
PID 2760 wrote to memory of 2908	2760	712affaa8b84e8fb7d4e71feb6c1074185bc43b5a2f265fbfb248f7ed40a5489 (1).exe	32
PID 2760 wrote to memory of 2908	2760	712affaa8b84e8fb7d4e71feb6c1074185bc43b5a2f265fbfb248f7ed40a5489 (1).exe	32
PID 2908 wrote to memory of 2724	2908	cmd.exe	33
PID 2908 wrote to memory of 2724	2908	cmd.exe	33
PID 2908 wrote to memory of 2724	2908	cmd.exe	33
PID 2908 wrote to memory of 2724	2908	cmd.exe	33

C:\Users\Admin\AppData\Local\Temp\712affaa8b84e8fb7d4e71feb6c1074185bc43b5a2f265fbfb248f7ed40a5489 (1).exe
"C:\Users\Admin\AppData\Local\Temp\712affaa8b84e8fb7d4e71feb6c1074185bc43b5a2f265fbfb248f7ed40a5489 (1).exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2760
- C:\Windows\SysWOW64\cmd.exe
  cmd /K ping 1.1.1.1 -n 1 -w 3000 > Nul & Del 712affaa8b84e8fb7d4e71feb6c1074185bc43b5a2f265fbfb248f7ed40a5489 (1).exe
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2908
- - C:\Windows\SysWOW64\PING.EXE
    ping 1.1.1.1 -n 1 -w 3000
    3⤵
    - Runs ping.exe
    PID:2724

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Remote System Discovery

T1018

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2760-0-0x0000000000400000-0x00000000005BE000-memory.dmp

Filesize
1.7MB

Download
memory/2760-2-0x0000000000400000-0x00000000005BE000-memory.dmp

Filesize
1.7MB

Download