f5ae13049ff90ed8b313c9c217522959ba9b5cd6cc651de196d58decc4aa60bd

Analysis

max time kernel
117s
max time network
118s
platform
windows7_x64
resource
win7-20240708-en
resource tags

arch:x64arch:x86image:win7-20240708-enlocale:en-usos:windows7-x64system
submitted
02/09/2024, 16:51

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

Eerie Cleaner V2.bat
Size

4KB
MD5

37ef21adf06934e902670dc77b93f91e
SHA1

e311a65512c8ded721846b07769800f36efe3e62
SHA256

f5ae13049ff90ed8b313c9c217522959ba9b5cd6cc651de196d58decc4aa60bd
SHA512

4b4814a4385c908976cc8f9b47223eeb651cff834024428b58602f34980b8c0c328e84dae2353f7abeb6e88f8575f8a1282726af3683eb2c6c228d4fad3e8775
SSDEEP

48:9dF/xamIWmN9m5lgFLtl+SSISno1hawpMv4R4MCG7nyb4tF5+gwkTp0Ro:9FIWmrClgFLP+SSISnkhaq+tA+QTpz

Score

3^/10

discovery

Malware Config

Signatures

System Network Configuration Discovery: Internet Connection Discovery 1 TTPs 21 IoCs

Adversaries may check for Internet connectivity on compromised systems.

discovery

Internet Connection Discovery

T1016.001

pid	Process
2848	PING.EXE
2856	PING.EXE
1732	PING.EXE
1152	PING.EXE
2464	PING.EXE
2712	PING.EXE
2864	PING.EXE
2916	PING.EXE
2720	PING.EXE
2512	PING.EXE
1340	PING.EXE
3048	PING.EXE
2220	PING.EXE
2612	PING.EXE
2888	PING.EXE
2648	PING.EXE
2016	PING.EXE
2096	PING.EXE
2800	PING.EXE
1688	PING.EXE
1540	PING.EXE

Runs ping.exe 1 TTPs 21 IoCs

Remote System Discovery

T1018

pid	Process
2612	PING.EXE
2888	PING.EXE
2648	PING.EXE
1340	PING.EXE
2464	PING.EXE
2848	PING.EXE
2712	PING.EXE
2864	PING.EXE
2720	PING.EXE
3048	PING.EXE
2220	PING.EXE
2016	PING.EXE
1540	PING.EXE
1732	PING.EXE
2916	PING.EXE
2512	PING.EXE
2856	PING.EXE
1688	PING.EXE
1152	PING.EXE
2096	PING.EXE
2800	PING.EXE

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2076 wrote to memory of 2540	2076	cmd.exe	31
PID 2076 wrote to memory of 2540	2076	cmd.exe	31
PID 2076 wrote to memory of 2540	2076	cmd.exe	31
PID 2076 wrote to memory of 2688	2076	cmd.exe	32
PID 2076 wrote to memory of 2688	2076	cmd.exe	32
PID 2076 wrote to memory of 2688	2076	cmd.exe	32
PID 2076 wrote to memory of 2096	2076	cmd.exe	33
PID 2076 wrote to memory of 2096	2076	cmd.exe	33
PID 2076 wrote to memory of 2096	2076	cmd.exe	33
PID 2076 wrote to memory of 2464	2076	cmd.exe	34
PID 2076 wrote to memory of 2464	2076	cmd.exe	34
PID 2076 wrote to memory of 2464	2076	cmd.exe	34
PID 2076 wrote to memory of 3048	2076	cmd.exe	35
PID 2076 wrote to memory of 3048	2076	cmd.exe	35
PID 2076 wrote to memory of 3048	2076	cmd.exe	35
PID 2076 wrote to memory of 2220	2076	cmd.exe	36
PID 2076 wrote to memory of 2220	2076	cmd.exe	36
PID 2076 wrote to memory of 2220	2076	cmd.exe	36
PID 2076 wrote to memory of 2712	2076	cmd.exe	37
PID 2076 wrote to memory of 2712	2076	cmd.exe	37
PID 2076 wrote to memory of 2712	2076	cmd.exe	37
PID 2076 wrote to memory of 2848	2076	cmd.exe	38
PID 2076 wrote to memory of 2848	2076	cmd.exe	38
PID 2076 wrote to memory of 2848	2076	cmd.exe	38
PID 2076 wrote to memory of 2864	2076	cmd.exe	39
PID 2076 wrote to memory of 2864	2076	cmd.exe	39
PID 2076 wrote to memory of 2864	2076	cmd.exe	39
PID 2076 wrote to memory of 2916	2076	cmd.exe	40
PID 2076 wrote to memory of 2916	2076	cmd.exe	40
PID 2076 wrote to memory of 2916	2076	cmd.exe	40
PID 2076 wrote to memory of 2612	2076	cmd.exe	41
PID 2076 wrote to memory of 2612	2076	cmd.exe	41
PID 2076 wrote to memory of 2612	2076	cmd.exe	41
PID 2076 wrote to memory of 2720	2076	cmd.exe	42
PID 2076 wrote to memory of 2720	2076	cmd.exe	42
PID 2076 wrote to memory of 2720	2076	cmd.exe	42
PID 2076 wrote to memory of 2888	2076	cmd.exe	43
PID 2076 wrote to memory of 2888	2076	cmd.exe	43
PID 2076 wrote to memory of 2888	2076	cmd.exe	43
PID 2076 wrote to memory of 2800	2076	cmd.exe	44
PID 2076 wrote to memory of 2800	2076	cmd.exe	44
PID 2076 wrote to memory of 2800	2076	cmd.exe	44
PID 2076 wrote to memory of 2856	2076	cmd.exe	45
PID 2076 wrote to memory of 2856	2076	cmd.exe	45
PID 2076 wrote to memory of 2856	2076	cmd.exe	45
PID 2076 wrote to memory of 2648	2076	cmd.exe	46
PID 2076 wrote to memory of 2648	2076	cmd.exe	46
PID 2076 wrote to memory of 2648	2076	cmd.exe	46
PID 2076 wrote to memory of 2512	2076	cmd.exe	47
PID 2076 wrote to memory of 2512	2076	cmd.exe	47
PID 2076 wrote to memory of 2512	2076	cmd.exe	47
PID 2076 wrote to memory of 1340	2076	cmd.exe	48
PID 2076 wrote to memory of 1340	2076	cmd.exe	48
PID 2076 wrote to memory of 1340	2076	cmd.exe	48
PID 2076 wrote to memory of 1688	2076	cmd.exe	49
PID 2076 wrote to memory of 1688	2076	cmd.exe	49
PID 2076 wrote to memory of 1688	2076	cmd.exe	49
PID 2076 wrote to memory of 2016	2076	cmd.exe	50
PID 2076 wrote to memory of 2016	2076	cmd.exe	50
PID 2076 wrote to memory of 2016	2076	cmd.exe	50
PID 2076 wrote to memory of 1540	2076	cmd.exe	51
PID 2076 wrote to memory of 1540	2076	cmd.exe	51
PID 2076 wrote to memory of 1540	2076	cmd.exe	51
PID 2076 wrote to memory of 1732	2076	cmd.exe	52

C:\Windows\system32\cmd.exe
cmd /c "C:\Users\Admin\AppData\Local\Temp\Eerie Cleaner V2.bat"
1⤵
- Suspicious use of WriteProcessMemory
PID:2076
- C:\Windows\system32\mode.com
  mode 80, 28
  2⤵
  PID:2540
- C:\Windows\system32\chcp.com
  chcp 65001
  2⤵
  PID:2688
- C:\Windows\system32\PING.EXE
  ping localhost -n 2
  2⤵
  - System Network Configuration Discovery: Internet Connection Discovery
  - Runs ping.exe
  PID:2096
- C:\Windows\system32\PING.EXE
  ping localhost -n 1
  2⤵
  - System Network Configuration Discovery: Internet Connection Discovery
  - Runs ping.exe
  PID:2464
- C:\Windows\system32\PING.EXE
  ping localhost -n 1
  2⤵
  - System Network Configuration Discovery: Internet Connection Discovery
  - Runs ping.exe
  PID:3048
- C:\Windows\system32\PING.EXE
  ping localhost -n 1
  2⤵
  - System Network Configuration Discovery: Internet Connection Discovery
  - Runs ping.exe
  PID:2220
- C:\Windows\system32\PING.EXE
  ping localhost -n 1
  2⤵
  - System Network Configuration Discovery: Internet Connection Discovery
  - Runs ping.exe
  PID:2712
- C:\Windows\system32\PING.EXE
  ping localhost -n 1
  2⤵
  - System Network Configuration Discovery: Internet Connection Discovery
  - Runs ping.exe
  PID:2848
- C:\Windows\system32\PING.EXE
  ping localhost -n 1
  2⤵
  - System Network Configuration Discovery: Internet Connection Discovery
  - Runs ping.exe
  PID:2864
- C:\Windows\system32\PING.EXE
  ping localhost -n 1
  2⤵
  - System Network Configuration Discovery: Internet Connection Discovery
  - Runs ping.exe
  PID:2916
- C:\Windows\system32\PING.EXE
  ping localhost -n 1
  2⤵
  - System Network Configuration Discovery: Internet Connection Discovery
  - Runs ping.exe
  PID:2612
- C:\Windows\system32\PING.EXE
  ping localhost -n 1
  2⤵
  - System Network Configuration Discovery: Internet Connection Discovery
  - Runs ping.exe
  PID:2720
- C:\Windows\system32\PING.EXE
  ping localhost -n 1
  2⤵
  - System Network Configuration Discovery: Internet Connection Discovery
  - Runs ping.exe
  PID:2888
- C:\Windows\system32\PING.EXE
  ping localhost -n 1
  2⤵
  - System Network Configuration Discovery: Internet Connection Discovery
  - Runs ping.exe
  PID:2800
- C:\Windows\system32\PING.EXE
  ping localhost -n 1
  2⤵
  - System Network Configuration Discovery: Internet Connection Discovery
  - Runs ping.exe
  PID:2856
- C:\Windows\system32\PING.EXE
  ping localhost -n 1
  2⤵
  - System Network Configuration Discovery: Internet Connection Discovery
  - Runs ping.exe
  PID:2648
- C:\Windows\system32\PING.EXE
  ping localhost -n 1
  2⤵
  - System Network Configuration Discovery: Internet Connection Discovery
  - Runs ping.exe
  PID:2512
- C:\Windows\system32\PING.EXE
  ping localhost -n 1
  2⤵
  - System Network Configuration Discovery: Internet Connection Discovery
  - Runs ping.exe
  PID:1340
- C:\Windows\system32\PING.EXE
  ping localhost -n 1
  2⤵
  - System Network Configuration Discovery: Internet Connection Discovery
  - Runs ping.exe
  PID:1688
- C:\Windows\system32\PING.EXE
  ping localhost -n 1
  2⤵
  - System Network Configuration Discovery: Internet Connection Discovery
  - Runs ping.exe
  PID:2016
- C:\Windows\system32\PING.EXE
  ping localhost -n 1
  2⤵
  - System Network Configuration Discovery: Internet Connection Discovery
  - Runs ping.exe
  PID:1540
- C:\Windows\system32\PING.EXE
  ping localhost -n 1
  2⤵
  - System Network Configuration Discovery: Internet Connection Discovery
  - Runs ping.exe
  PID:1732
- C:\Windows\system32\PING.EXE
  ping localhost -n 1
  2⤵
  - System Network Configuration Discovery: Internet Connection Discovery
  - Runs ping.exe
  PID:1152
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /S /D /c" echo"
  2⤵
  PID:2364
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /S /D /c" set /p=". [34mSelect an option: [0m""
  2⤵
  PID:1052
- C:\Windows\system32\choice.exe
  choice /c 123456789AB
  2⤵
  PID:1720

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Remote System Discovery

T1018

System Network Configuration Discovery

T1016

Internet Connection Discovery

T1016.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Windows 7 deprecation

Loading Replay Monitor...