44830ff5dfe7dcce62b8d8a4ce421f54a6ee269339ec15710af554481e631672

Analysis

max time kernel
148s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
20/08/2024, 14:45

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

echo off.bat
Size

1KB
MD5

7c8791448bff630f8ac60efdc9bbac4c
SHA1

ff54860d232637cce9fe4ddc6ff9d692d4c64280
SHA256

44830ff5dfe7dcce62b8d8a4ce421f54a6ee269339ec15710af554481e631672
SHA512

2a8db0334ce150c7cc9cb3d7d7bf5f737c738ab1d8996ddc18174926e9c9d269a9acc2033a0b8fd7e624ffd8a5c1c96759b8ef887baae92228af9da5b86a2120

Score

3^/10

discovery

Malware Config

Signatures

System Network Configuration Discovery: Internet Connection Discovery 1 TTPs 64 IoCs

Adversaries may check for Internet connectivity on compromised systems.

discovery

Internet Connection Discovery

T1016.001

pid	Process
1460	PING.EXE
4040	PING.EXE
4268	PING.EXE
3944	PING.EXE
2620	PING.EXE
3420	PING.EXE
2392	PING.EXE
4152	PING.EXE
536	PING.EXE
1768	PING.EXE
4380	PING.EXE
748	PING.EXE
4740	PING.EXE
2824	PING.EXE
536	PING.EXE
2556	PING.EXE
2864	PING.EXE
448	PING.EXE
4460	PING.EXE
4408	PING.EXE
2084	PING.EXE
4396	PING.EXE
3468	PING.EXE
2220	PING.EXE
4564	PING.EXE
4276	PING.EXE
3244	PING.EXE
4064	PING.EXE
3216	PING.EXE
3124	PING.EXE
1728	PING.EXE
3244	PING.EXE
1036	PING.EXE
5100	PING.EXE
4076	PING.EXE
2272	PING.EXE
1248	PING.EXE
4300	PING.EXE
3212	PING.EXE
1936	PING.EXE
3868	PING.EXE
4976	PING.EXE
4716	PING.EXE
796	PING.EXE
1548	PING.EXE
2008	PING.EXE
3404	PING.EXE
1112	PING.EXE
4048	PING.EXE
2416	PING.EXE
4064	PING.EXE
1664	PING.EXE
4468	PING.EXE
1928	PING.EXE
2992	PING.EXE
2996	PING.EXE
692	PING.EXE
808	PING.EXE
2552	PING.EXE
3728	PING.EXE
2240	PING.EXE
2020	PING.EXE
1392	PING.EXE
1436	PING.EXE

Runs ping.exe 1 TTPs 64 IoCs

Remote System Discovery

T1018

pid	Process
1460	PING.EXE
2020	PING.EXE
4740	PING.EXE
4380	PING.EXE
4300	PING.EXE
536	PING.EXE
748	PING.EXE
2864	PING.EXE
4388	PING.EXE
828	PING.EXE
4276	PING.EXE
4984	PING.EXE
2556	PING.EXE
4928	PING.EXE
1120	PING.EXE
4152	PING.EXE
3244	PING.EXE
3292	PING.EXE
1036	PING.EXE
1436	PING.EXE
4468	PING.EXE
1928	PING.EXE
3728	PING.EXE
4976	PING.EXE
4460	PING.EXE
5072	PING.EXE
3868	PING.EXE
3648	PING.EXE
2824	PING.EXE
2788	PING.EXE
3524	PING.EXE
1292	PING.EXE
4040	PING.EXE
4064	PING.EXE
5016	PING.EXE
4988	PING.EXE
1768	PING.EXE
3404	PING.EXE
2416	PING.EXE
756	PING.EXE
1936	PING.EXE
1664	PING.EXE
2220	PING.EXE
3152	PING.EXE
2556	PING.EXE
3468	PING.EXE
1728	PING.EXE
4564	PING.EXE
3212	PING.EXE
1248	PING.EXE
3456	PING.EXE
4408	PING.EXE
4716	PING.EXE
4964	PING.EXE
5100	PING.EXE
4396	PING.EXE
1284	PING.EXE
2996	PING.EXE
2992	PING.EXE
4660	PING.EXE
1284	PING.EXE
4152	PING.EXE
3420	PING.EXE
4064	PING.EXE

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 868 wrote to memory of 1900	868	cmd.exe	85
PID 868 wrote to memory of 1900	868	cmd.exe	85
PID 868 wrote to memory of 1768	868	cmd.exe	87
PID 868 wrote to memory of 1768	868	cmd.exe	87
PID 868 wrote to memory of 1392	868	cmd.exe	88
PID 868 wrote to memory of 1392	868	cmd.exe	88
PID 868 wrote to memory of 3244	868	cmd.exe	89
PID 868 wrote to memory of 3244	868	cmd.exe	89
PID 868 wrote to memory of 1928	868	cmd.exe	90
PID 868 wrote to memory of 1928	868	cmd.exe	90
PID 868 wrote to memory of 1436	868	cmd.exe	91
PID 868 wrote to memory of 1436	868	cmd.exe	91
PID 868 wrote to memory of 1060	868	cmd.exe	92
PID 868 wrote to memory of 1060	868	cmd.exe	92
PID 868 wrote to memory of 4468	868	cmd.exe	93
PID 868 wrote to memory of 4468	868	cmd.exe	93
PID 868 wrote to memory of 4380	868	cmd.exe	94
PID 868 wrote to memory of 4380	868	cmd.exe	94
PID 868 wrote to memory of 1284	868	cmd.exe	95
PID 868 wrote to memory of 1284	868	cmd.exe	95
PID 868 wrote to memory of 2996	868	cmd.exe	97
PID 868 wrote to memory of 2996	868	cmd.exe	97
PID 868 wrote to memory of 4408	868	cmd.exe	98
PID 868 wrote to memory of 4408	868	cmd.exe	98
PID 868 wrote to memory of 3944	868	cmd.exe	99
PID 868 wrote to memory of 3944	868	cmd.exe	99
PID 868 wrote to memory of 4716	868	cmd.exe	100
PID 868 wrote to memory of 4716	868	cmd.exe	100
PID 868 wrote to memory of 1548	868	cmd.exe	101
PID 868 wrote to memory of 1548	868	cmd.exe	101
PID 868 wrote to memory of 3728	868	cmd.exe	102
PID 868 wrote to memory of 3728	868	cmd.exe	102
PID 868 wrote to memory of 3128	868	cmd.exe	103
PID 868 wrote to memory of 3128	868	cmd.exe	103
PID 868 wrote to memory of 2240	868	cmd.exe	104
PID 868 wrote to memory of 2240	868	cmd.exe	104
PID 868 wrote to memory of 3404	868	cmd.exe	105
PID 868 wrote to memory of 3404	868	cmd.exe	105
PID 868 wrote to memory of 2556	868	cmd.exe	106
PID 868 wrote to memory of 2556	868	cmd.exe	106
PID 868 wrote to memory of 4064	868	cmd.exe	107
PID 868 wrote to memory of 4064	868	cmd.exe	107
PID 868 wrote to memory of 3292	868	cmd.exe	109
PID 868 wrote to memory of 3292	868	cmd.exe	109
PID 868 wrote to memory of 4564	868	cmd.exe	110
PID 868 wrote to memory of 4564	868	cmd.exe	110
PID 868 wrote to memory of 3212	868	cmd.exe	111
PID 868 wrote to memory of 3212	868	cmd.exe	111
PID 868 wrote to memory of 4152	868	cmd.exe	112
PID 868 wrote to memory of 4152	868	cmd.exe	112
PID 868 wrote to memory of 4964	868	cmd.exe	114
PID 868 wrote to memory of 4964	868	cmd.exe	114
PID 868 wrote to memory of 536	868	cmd.exe	115
PID 868 wrote to memory of 536	868	cmd.exe	115
PID 868 wrote to memory of 5072	868	cmd.exe	116
PID 868 wrote to memory of 5072	868	cmd.exe	116
PID 868 wrote to memory of 2992	868	cmd.exe	117
PID 868 wrote to memory of 2992	868	cmd.exe	117
PID 868 wrote to memory of 4076	868	cmd.exe	118
PID 868 wrote to memory of 4076	868	cmd.exe	118
PID 868 wrote to memory of 2084	868	cmd.exe	119
PID 868 wrote to memory of 2084	868	cmd.exe	119
PID 868 wrote to memory of 2620	868	cmd.exe	120
PID 868 wrote to memory of 2620	868	cmd.exe	120

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\echo off.bat"
1⤵
- Suspicious use of WriteProcessMemory
PID:868
- C:\Windows\system32\PING.EXE
  ping -n 1 -w 20 127.0.0.1
  2⤵
  PID:1900
- C:\Windows\system32\PING.EXE
  ping -n 1 -w 20 127.0.0.1
  2⤵
  - System Network Configuration Discovery: Internet Connection Discovery
  - Runs ping.exe
  PID:1768
- C:\Windows\system32\PING.EXE
  ping -n 1 -w 20 127.0.0.1
  2⤵
  - System Network Configuration Discovery: Internet Connection Discovery
  PID:1392
- C:\Windows\system32\PING.EXE
  ping -n 1 -w 20 127.0.0.1
  2⤵
  - System Network Configuration Discovery: Internet Connection Discovery
  - Runs ping.exe
  PID:3244
- C:\Windows\system32\PING.EXE
  ping -n 1 -w 20 127.0.0.1
  2⤵
  - System Network Configuration Discovery: Internet Connection Discovery
  - Runs ping.exe
  PID:1928
- C:\Windows\system32\PING.EXE
  ping -n 1 -w 20 127.0.0.1
  2⤵
  - System Network Configuration Discovery: Internet Connection Discovery
  - Runs ping.exe
  PID:1436
- C:\Windows\system32\PING.EXE
  ping -n 1 -w 20 127.0.0.1
  2⤵
  PID:1060
- C:\Windows\system32\PING.EXE
  ping -n 1 -w 20 127.0.0.1
  2⤵
  - System Network Configuration Discovery: Internet Connection Discovery
  - Runs ping.exe
  PID:4468
- C:\Windows\system32\PING.EXE
  ping -n 1 -w 20 127.0.0.1
  2⤵
  - System Network Configuration Discovery: Internet Connection Discovery
  - Runs ping.exe
  PID:4380
- C:\Windows\system32\PING.EXE
  ping -n 1 -w 20 127.0.0.1
  2⤵
  - Runs ping.exe
  PID:1284
- C:\Windows\system32\PING.EXE
  ping -n 1 -w 20 127.0.0.1
  2⤵
  - System Network Configuration Discovery: Internet Connection Discovery
  - Runs ping.exe
  PID:2996
- C:\Windows\system32\PING.EXE
  ping -n 1 -w 20 127.0.0.1
  2⤵
  - System Network Configuration Discovery: Internet Connection Discovery
  - Runs ping.exe
  PID:4408
- C:\Windows\system32\PING.EXE
  ping -n 1 -w 20 127.0.0.1
  2⤵
  - System Network Configuration Discovery: Internet Connection Discovery
  PID:3944
- C:\Windows\system32\PING.EXE
  ping -n 1 -w 20 127.0.0.1
  2⤵
  - System Network Configuration Discovery: Internet Connection Discovery
  - Runs ping.exe
  PID:4716
- C:\Windows\system32\PING.EXE
  ping -n 1 -w 20 127.0.0.1
  2⤵
  - System Network Configuration Discovery: Internet Connection Discovery
  PID:1548
- C:\Windows\system32\PING.EXE
  ping -n 1 -w 20 127.0.0.1
  2⤵
  - System Network Configuration Discovery: Internet Connection Discovery
  - Runs ping.exe
  PID:3728
- C:\Windows\system32\PING.EXE
  ping -n 1 -w 20 127.0.0.1
  2⤵
  PID:3128
- C:\Windows\system32\PING.EXE
  ping -n 1 -w 20 127.0.0.1
  2⤵
  - System Network Configuration Discovery: Internet Connection Discovery
  PID:2240
- C:\Windows\system32\PING.EXE
  ping -n 1 -w 20 127.0.0.1
  2⤵
  - System Network Configuration Discovery: Internet Connection Discovery
  - Runs ping.exe
  PID:3404
- C:\Windows\system32\PING.EXE
  ping -n 1 -w 20 127.0.0.1
  2⤵
  - System Network Configuration Discovery: Internet Connection Discovery
  - Runs ping.exe
  PID:2556
- C:\Windows\system32\PING.EXE
  ping -n 1 -w 20 127.0.0.1
  2⤵
  - System Network Configuration Discovery: Internet Connection Discovery
  - Runs ping.exe
  PID:4064
- C:\Windows\system32\PING.EXE
  ping -n 1 -w 20 127.0.0.1
  2⤵
  - Runs ping.exe
  PID:3292
- C:\Windows\system32\PING.EXE
  ping -n 1 -w 20 127.0.0.1
  2⤵
  - System Network Configuration Discovery: Internet Connection Discovery
  - Runs ping.exe
  PID:4564
- C:\Windows\system32\PING.EXE
  ping -n 1 -w 20 127.0.0.1
  2⤵
  - System Network Configuration Discovery: Internet Connection Discovery
  - Runs ping.exe
  PID:3212
- C:\Windows\system32\PING.EXE
  ping -n 1 -w 20 127.0.0.1
  2⤵
  - Runs ping.exe
  PID:4152
- C:\Windows\system32\PING.EXE
  ping -n 1 -w 20 127.0.0.1
  2⤵
  - Runs ping.exe
  PID:4964
- C:\Windows\system32\PING.EXE
  ping -n 1 -w 20 127.0.0.1
  2⤵
  - System Network Configuration Discovery: Internet Connection Discovery
  PID:536
- C:\Windows\system32\PING.EXE
  ping -n 1 -w 20 127.0.0.1
  2⤵
  - Runs ping.exe
  PID:5072
- C:\Windows\system32\PING.EXE
  ping -n 1 -w 20 127.0.0.1
  2⤵
  - System Network Configuration Discovery: Internet Connection Discovery
  - Runs ping.exe
  PID:2992
- C:\Windows\system32\PING.EXE
  ping -n 1 -w 20 127.0.0.1
  2⤵
  - System Network Configuration Discovery: Internet Connection Discovery
  PID:4076
- C:\Windows\system32\PING.EXE
  ping -n 1 -w 20 127.0.0.1
  2⤵
  - System Network Configuration Discovery: Internet Connection Discovery
  PID:2084
- C:\Windows\system32\PING.EXE
  ping -n 1 -w 20 127.0.0.1
  2⤵
  - System Network Configuration Discovery: Internet Connection Discovery
  PID:2620
- C:\Windows\system32\PING.EXE
  ping -n 1 -w 20 127.0.0.1
  2⤵
  - System Network Configuration Discovery: Internet Connection Discovery
  - Runs ping.exe
  PID:3868
- C:\Windows\system32\PING.EXE
  ping -n 1 -w 20 127.0.0.1
  2⤵
  PID:4796
- C:\Windows\system32\PING.EXE
  ping -n 1 -w 20 127.0.0.1
  2⤵
  - System Network Configuration Discovery: Internet Connection Discovery
  - Runs ping.exe
  PID:1036
- C:\Windows\system32\PING.EXE
  ping -n 1 -w 20 127.0.0.1
  2⤵
  - Runs ping.exe
  PID:3152
- C:\Windows\system32\PING.EXE
  ping -n 1 -w 20 127.0.0.1
  2⤵
  - Runs ping.exe
  PID:3648
- C:\Windows\system32\PING.EXE
  ping -n 1 -w 20 127.0.0.1
  2⤵
  PID:1636
- C:\Windows\system32\PING.EXE
  ping -n 1 -w 20 127.0.0.1
  2⤵
  - System Network Configuration Discovery: Internet Connection Discovery
  PID:692
- C:\Windows\system32\PING.EXE
  ping -n 1 -w 20 127.0.0.1
  2⤵
  - Runs ping.exe
  PID:4928
- C:\Windows\system32\PING.EXE
  ping -n 1 -w 20 127.0.0.1
  2⤵
  - System Network Configuration Discovery: Internet Connection Discovery
  PID:2272
- C:\Windows\system32\PING.EXE
  ping -n 1 -w 20 127.0.0.1
  2⤵
  PID:3592
- C:\Windows\system32\PING.EXE
  ping -n 1 -w 20 127.0.0.1
  2⤵
  - Runs ping.exe
  PID:2788
- C:\Windows\system32\PING.EXE
  ping -n 1 -w 20 127.0.0.1
  2⤵
  - System Network Configuration Discovery: Internet Connection Discovery
  PID:448
- C:\Windows\system32\PING.EXE
  ping -n 1 -w 20 127.0.0.1
  2⤵
  - System Network Configuration Discovery: Internet Connection Discovery
  - Runs ping.exe
  PID:5100
- C:\Windows\system32\PING.EXE
  ping -n 1 -w 20 127.0.0.1
  2⤵
  - System Network Configuration Discovery: Internet Connection Discovery
  - Runs ping.exe
  PID:1248
- C:\Windows\system32\PING.EXE
  ping -n 1 -w 20 127.0.0.1
  2⤵
  - System Network Configuration Discovery: Internet Connection Discovery
  - Runs ping.exe
  PID:3420
- C:\Windows\system32\PING.EXE
  ping -n 1 -w 20 127.0.0.1
  2⤵
  - System Network Configuration Discovery: Internet Connection Discovery
  - Runs ping.exe
  PID:4276
- C:\Windows\system32\PING.EXE
  ping -n 1 -w 20 127.0.0.1
  2⤵
  - System Network Configuration Discovery: Internet Connection Discovery
  - Runs ping.exe
  PID:4300
- C:\Windows\system32\PING.EXE
  ping -n 1 -w 20 127.0.0.1
  2⤵
  - System Network Configuration Discovery: Internet Connection Discovery
  PID:1112
- C:\Windows\system32\PING.EXE
  ping -n 1 -w 20 127.0.0.1
  2⤵
  - System Network Configuration Discovery: Internet Connection Discovery
  PID:2552
- C:\Windows\system32\PING.EXE
  ping -n 1 -w 20 127.0.0.1
  2⤵
  - Runs ping.exe
  PID:4660
- C:\Windows\system32\PING.EXE
  ping -n 1 -w 20 127.0.0.1
  2⤵
  - Runs ping.exe
  PID:5016
- C:\Windows\system32\PING.EXE
  ping -n 1 -w 20 127.0.0.1
  2⤵
  - System Network Configuration Discovery: Internet Connection Discovery
  PID:4048
- C:\Windows\system32\PING.EXE
  ping -n 1 -w 20 127.0.0.1
  2⤵
  - System Network Configuration Discovery: Internet Connection Discovery
  PID:4268
- C:\Windows\system32\PING.EXE
  ping -n 1 -w 20 127.0.0.1
  2⤵
  PID:2708
- C:\Windows\system32\PING.EXE
  ping -n 1 -w 20 127.0.0.1
  2⤵
  - System Network Configuration Discovery: Internet Connection Discovery
  - Runs ping.exe
  PID:4976
- C:\Windows\system32\PING.EXE
  ping -n 1 -w 20 127.0.0.1
  2⤵
  - Runs ping.exe
  PID:1284
- C:\Windows\system32\PING.EXE
  ping -n 1 -w 20 127.0.0.1
  2⤵
  - System Network Configuration Discovery: Internet Connection Discovery
  - Runs ping.exe
  PID:1460
- C:\Windows\system32\PING.EXE
  ping -n 1 -w 20 127.0.0.1
  2⤵
  - System Network Configuration Discovery: Internet Connection Discovery
  - Runs ping.exe
  PID:4396
- C:\Windows\system32\PING.EXE
  ping -n 1 -w 20 127.0.0.1
  2⤵
  - Runs ping.exe
  PID:4988
- C:\Windows\system32\PING.EXE
  ping -n 1 -w 20 127.0.0.1
  2⤵
  - System Network Configuration Discovery: Internet Connection Discovery
  - Runs ping.exe
  PID:2416
- C:\Windows\system32\PING.EXE
  ping -n 1 -w 20 127.0.0.1
  2⤵
  - System Network Configuration Discovery: Internet Connection Discovery
  PID:2392
- C:\Windows\system32\PING.EXE
  ping -n 1 -w 20 127.0.0.1
  2⤵
  - System Network Configuration Discovery: Internet Connection Discovery
  - Runs ping.exe
  PID:4460
- C:\Windows\system32\PING.EXE
  ping -n 1 -w 20 127.0.0.1
  2⤵
  - Runs ping.exe
  PID:756
- C:\Windows\system32\PING.EXE
  ping -n 1 -w 20 127.0.0.1
  2⤵
  - Runs ping.exe
  PID:4984
- C:\Windows\system32\PING.EXE
  ping -n 1 -w 20 127.0.0.1
  2⤵
  - System Network Configuration Discovery: Internet Connection Discovery
  - Runs ping.exe
  PID:2020
- C:\Windows\system32\PING.EXE
  ping -n 1 -w 20 127.0.0.1
  2⤵
  - Runs ping.exe
  PID:2556
- C:\Windows\system32\PING.EXE
  ping -n 1 -w 20 127.0.0.1
  2⤵
  - System Network Configuration Discovery: Internet Connection Discovery
  - Runs ping.exe
  PID:4064
- C:\Windows\system32\PING.EXE
  ping -n 1 -w 20 127.0.0.1
  2⤵
  - System Network Configuration Discovery: Internet Connection Discovery
  - Runs ping.exe
  PID:3468
- C:\Windows\system32\PING.EXE
  ping -n 1 -w 20 127.0.0.1
  2⤵
  PID:1496
- C:\Windows\system32\PING.EXE
  ping -n 1 -w 20 127.0.0.1
  2⤵
  - Runs ping.exe
  PID:3524
- C:\Windows\system32\PING.EXE
  ping -n 1 -w 20 127.0.0.1
  2⤵
  PID:1332
- C:\Windows\system32\PING.EXE
  ping -n 1 -w 20 127.0.0.1
  2⤵
  - Runs ping.exe
  PID:1120
- C:\Windows\system32\PING.EXE
  ping -n 1 -w 20 127.0.0.1
  2⤵
  - System Network Configuration Discovery: Internet Connection Discovery
  - Runs ping.exe
  PID:4152
- C:\Windows\system32\PING.EXE
  ping -n 1 -w 20 127.0.0.1
  2⤵
  - System Network Configuration Discovery: Internet Connection Discovery
  PID:808
- C:\Windows\system32\PING.EXE
  ping -n 1 -w 20 127.0.0.1
  2⤵
  - System Network Configuration Discovery: Internet Connection Discovery
  - Runs ping.exe
  PID:536
- C:\Windows\system32\PING.EXE
  ping -n 1 -w 20 127.0.0.1
  2⤵
  - System Network Configuration Discovery: Internet Connection Discovery
  - Runs ping.exe
  PID:748
- C:\Windows\system32\PING.EXE
  ping -n 1 -w 20 127.0.0.1
  2⤵
  PID:3744
- C:\Windows\system32\PING.EXE
  ping -n 1 -w 20 127.0.0.1
  2⤵
  PID:3756
- C:\Windows\system32\PING.EXE
  ping -n 1 -w 20 127.0.0.1
  2⤵
  PID:3752
- C:\Windows\system32\PING.EXE
  ping -n 1 -w 20 127.0.0.1
  2⤵
  - System Network Configuration Discovery: Internet Connection Discovery
  - Runs ping.exe
  PID:2824
- C:\Windows\system32\PING.EXE
  ping -n 1 -w 20 127.0.0.1
  2⤵
  - System Network Configuration Discovery: Internet Connection Discovery
  - Runs ping.exe
  PID:1936
- C:\Windows\system32\PING.EXE
  ping -n 1 -w 20 127.0.0.1
  2⤵
  PID:408
- C:\Windows\system32\PING.EXE
  ping -n 1 -w 20 127.0.0.1
  2⤵
  - Runs ping.exe
  PID:1292
- C:\Windows\system32\PING.EXE
  ping -n 1 -w 20 127.0.0.1
  2⤵
  - System Network Configuration Discovery: Internet Connection Discovery
  PID:3124
- C:\Windows\system32\PING.EXE
  ping -n 1 -w 20 127.0.0.1
  2⤵
  - System Network Configuration Discovery: Internet Connection Discovery
  - Runs ping.exe
  PID:1664
- C:\Windows\system32\PING.EXE
  ping -n 1 -w 20 127.0.0.1
  2⤵
  - Runs ping.exe
  PID:3456
- C:\Windows\system32\PING.EXE
  ping -n 1 -w 20 127.0.0.1
  2⤵
  - System Network Configuration Discovery: Internet Connection Discovery
  PID:3216
- C:\Windows\system32\PING.EXE
  ping -n 1 -w 20 127.0.0.1
  2⤵
  - System Network Configuration Discovery: Internet Connection Discovery
  PID:2008
- C:\Windows\system32\PING.EXE
  ping -n 1 -w 20 127.0.0.1
  2⤵
  - System Network Configuration Discovery: Internet Connection Discovery
  - Runs ping.exe
  PID:1728
- C:\Windows\system32\PING.EXE
  ping -n 1 -w 20 127.0.0.1
  2⤵
  - System Network Configuration Discovery: Internet Connection Discovery
  - Runs ping.exe
  PID:4040
- C:\Windows\system32\PING.EXE
  ping -n 1 -w 20 127.0.0.1
  2⤵
  - System Network Configuration Discovery: Internet Connection Discovery
  - Runs ping.exe
  PID:2864
- C:\Windows\system32\PING.EXE
  ping -n 1 -w 20 127.0.0.1
  2⤵
  PID:1768
- C:\Windows\system32\PING.EXE
  ping -n 1 -w 20 127.0.0.1
  2⤵
  - System Network Configuration Discovery: Internet Connection Discovery
  - Runs ping.exe
  PID:2220
- C:\Windows\system32\PING.EXE
  ping -n 1 -w 20 127.0.0.1
  2⤵
  - System Network Configuration Discovery: Internet Connection Discovery
  PID:3244
- C:\Windows\system32\PING.EXE
  ping -n 1 -w 20 127.0.0.1
  2⤵
  - System Network Configuration Discovery: Internet Connection Discovery
  - Runs ping.exe
  PID:4740
- C:\Windows\system32\PING.EXE
  ping -n 1 -w 20 127.0.0.1
  2⤵
  - Runs ping.exe
  PID:4388
- C:\Windows\system32\PING.EXE
  ping -n 1 -w 20 127.0.0.1
  2⤵
  - Runs ping.exe
  PID:828
- C:\Windows\system32\PING.EXE
  ping -n 1 -w 20 127.0.0.1
  2⤵
  - System Network Configuration Discovery: Internet Connection Discovery
  PID:796

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Remote System Discovery

T1018

System Network Configuration Discovery

T1016

Internet Connection Discovery

T1016.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads