a0cf5a8479dc455e49f5bfaacbe5cd36cb6fb4e828b31338c740252cebbcc691

Analysis

max time kernel
543s
max time network
420s
platform
windows10-2004_x64
resource
win10v2004-20240709-en
resource tags

arch:x64arch:x86image:win10v2004-20240709-enlocale:en-usos:windows10-2004-x64system
submitted
23/07/2024, 04:07

Target

test.bat
Size

740B
MD5

4070e8acbbebf006e7a275895a798e0f
SHA1

597bb7e1f12594b87fd00800acab335fb71afe94
SHA256

a0cf5a8479dc455e49f5bfaacbe5cd36cb6fb4e828b31338c740252cebbcc691
SHA512

c9089fc33f89d4da1682615bb3d7aacae09b9f9b8729482e48fb90606c291845a95f47e14fdca5a98aae1b15967eb0dc371ed6b4f0d63818d45a10db16c9fc25

Score

1^/10

Runs ping.exe 1 TTPs 7 IoCs

Remote System Discovery

Suspicious use of WriteProcessMemory 16 IoCs

description	pid	Process	procid_target
PID 1184 wrote to memory of 3156	1184	cmd.exe	85
PID 1184 wrote to memory of 3156	1184	cmd.exe	85
PID 1184 wrote to memory of 3084	1184	cmd.exe	86
PID 1184 wrote to memory of 3084	1184	cmd.exe	86
PID 1184 wrote to memory of 4968	1184	cmd.exe	92
PID 1184 wrote to memory of 4968	1184	cmd.exe	92
PID 1184 wrote to memory of 1128	1184	cmd.exe	97
PID 1184 wrote to memory of 1128	1184	cmd.exe	97
PID 1184 wrote to memory of 1840	1184	cmd.exe	98
PID 1184 wrote to memory of 1840	1184	cmd.exe	98
PID 1184 wrote to memory of 5068	1184	cmd.exe	101
PID 1184 wrote to memory of 5068	1184	cmd.exe	101
PID 1184 wrote to memory of 1936	1184	cmd.exe	102
PID 1184 wrote to memory of 1936	1184	cmd.exe	102
PID 1184 wrote to memory of 1968	1184	cmd.exe	103
PID 1184 wrote to memory of 1968	1184	cmd.exe	103

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\test.bat"
1⤵
- Suspicious use of WriteProcessMemory
PID:1184
- C:\Windows\system32\mode.com
  mode 1000
  2⤵
  PID:3156
- C:\Windows\system32\PING.EXE
  ping localhost -n 3
  2⤵
  - Runs ping.exe
  PID:3084
- C:\Windows\system32\PING.EXE
  ping localhost -n 5
  2⤵
  - Runs ping.exe
  PID:4968
- C:\Windows\system32\PING.EXE
  ping localhost -n 3
  2⤵
  - Runs ping.exe
  PID:1128
- C:\Windows\system32\PING.EXE
  ping localhost -n 5
  2⤵
  - Runs ping.exe
  PID:1840
- C:\Windows\system32\PING.EXE
  ping localhost -n 3
  2⤵
  - Runs ping.exe
  PID:5068
- C:\Windows\system32\PING.EXE
  ping localhost -n 5
  2⤵
  - Runs ping.exe
  PID:1936
- C:\Windows\system32\PING.EXE
  ping localhost -n 3
  2⤵
  - Runs ping.exe
  PID:1968

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Remote System Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact