b886f0f57d9e944eb4b10c4d450a35de8c8c9600165763be791965018811d453

Analysis

user interaction
yes
max time kernel
6s
max time network
22s
platform
windows10-ltsc_2021_x64
resource
win10ltsc2021-20260130-en
resource tags

arch:x64arch:x86image:win10ltsc2021-20260130-enlocale:en-usos:windows10-ltsc_2021-x64systemwindows
submitted
20/04/2026, 18:12

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
random.exe
Size 68.4MB
Sample260420-wtbs4sdv3s
SHA256 b886f0f57d9e944eb4b10c4d450a35de8c8c9600165763be791965018811d453
MD5 32ef7ce014256c36fe3fe0cd53d9ffe5
SHA1 df7cc825e3d173342fb2f0d00ac2ed3baae891ef
SHA512 b995680d29b1008aeee232b04c6000521ca087e212c7978e0aa8311a34d5b8bc7ed3ea9ccf945a179276d5ef4bdb188a5012a9237bfd65105171bd190315fd72
SSDEEP 1572864:PDvKxhT1FgcW/JCkT0WhosMZT0wYFtRmECOfWZctdu:PDSxhpucA1T7oeY9IWwdu
TLSH
T1ECF72356E2FD00E8D9BAC0B8C6571617E7B13449173097EF56A48A692F37BE0AE3D310
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

discovery execution

Malware Config

Signatures

Command and Scripting Interpreter: PowerShell 1 TTPs 2 IoCs

Using powershell.exe command.

execution

PowerShell

T1059.001

pid	Process
2544	powershell.exe
4964	powershell.exe

System Network Configuration Discovery: Internet Connection Discovery 1 TTPs 64 IoCs

Adversaries may check for Internet connectivity on compromised systems.

discovery

Internet Connection Discovery

T1016.001

pid	Process
5972	PING.EXE
1568	PING.EXE
3232	PING.EXE
1160	PING.EXE
2784	PING.EXE
3204	PING.EXE
2556	PING.EXE
5180	cmd.exe
904	PING.EXE
3964	PING.EXE
4020	PING.EXE
1748	PING.EXE
2588	PING.EXE
5196	PING.EXE
2360	PING.EXE
2412	PING.EXE
6016	PING.EXE
1576	PING.EXE
4692	PING.EXE
2556	PING.EXE
900	cmd.exe
2784	PING.EXE
1480	PING.EXE
5556	PING.EXE
5276	PING.EXE
5620	PING.EXE
5740	PING.EXE
1224	PING.EXE
4620	PING.EXE
5284	PING.EXE
2888	PING.EXE
2928	PING.EXE
4644	PING.EXE
3484	PING.EXE
4692	PING.EXE
3256	PING.EXE
5676	PING.EXE
228	PING.EXE
5044	PING.EXE
5624	PING.EXE
4368	PING.EXE
3364	PING.EXE
2408	PING.EXE
3472	PING.EXE
1592	PING.EXE
5048	PING.EXE
320	PING.EXE
5160	PING.EXE
5072	PING.EXE
4548	PING.EXE
5428	PING.EXE
1664	PING.EXE
3436	PING.EXE
4420	PING.EXE
2472	PING.EXE
404	PING.EXE
4916	PING.EXE
4328	PING.EXE
4708	PING.EXE
728	PING.EXE
3392	PING.EXE
1828	PING.EXE
4708	PING.EXE
424	PING.EXE

Runs ping.exe 1 TTPs 64 IoCs

Remote System Discovery

T1018

pid	Process
3472	PING.EXE
4536	PING.EXE
5072	PING.EXE
568	PING.EXE
2808	PING.EXE
5356	PING.EXE
5916	PING.EXE
5764	PING.EXE
4020	PING.EXE
3552	PING.EXE
5404	PING.EXE
1480	PING.EXE
5668	PING.EXE
1568	PING.EXE
2528	PING.EXE
1484	PING.EXE
5436	PING.EXE
5572	PING.EXE
3108	PING.EXE
944	PING.EXE
1480	PING.EXE
2364	PING.EXE
328	PING.EXE
5524	PING.EXE
4928	PING.EXE
5676	PING.EXE
2472	PING.EXE
3704	PING.EXE
4368	PING.EXE
6000	PING.EXE
4152	PING.EXE
4512	PING.EXE
5680	PING.EXE
4520	PING.EXE
5640	PING.EXE
5992	PING.EXE
3328	PING.EXE
5620	PING.EXE
3204	PING.EXE
2692	PING.EXE
1224	PING.EXE
1036	PING.EXE
2828	PING.EXE
2304	PING.EXE
2808	PING.EXE
5400	PING.EXE
1528	PING.EXE
3520	PING.EXE
2636	PING.EXE
5516	PING.EXE
4688	PING.EXE
2408	PING.EXE
3096	PING.EXE
3668	PING.EXE
4292	PING.EXE
1888	PING.EXE
820	PING.EXE
5272	PING.EXE
5188	PING.EXE
2488	PING.EXE
5184	PING.EXE
5204	PING.EXE
4328	PING.EXE
3396	PING.EXE

Suspicious behavior: EnumeratesProcesses 5 IoCs

pid	Process
2544	powershell.exe
2544	powershell.exe
4964	powershell.exe
4964	powershell.exe
4964	powershell.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	2544	powershell.exe
Token: SeDebugPrivilege	4964	powershell.exe

Suspicious use of WriteProcessMemory 29 IoCs

description	pid	Process	procid_target
PID 4888 wrote to memory of 2544	4888	random.exe	83
PID 2544 wrote to memory of 1220	2544	powershell.exe	85
PID 2544 wrote to memory of 5208	2544	powershell.exe	87
PID 2544 wrote to memory of 3996	2544	powershell.exe	89
PID 2544 wrote to memory of 900	2544	powershell.exe	91
PID 2544 wrote to memory of 816	2544	powershell.exe	93
PID 2544 wrote to memory of 1684	2544	powershell.exe	95
PID 2544 wrote to memory of 5180	2544	powershell.exe	97
PID 2544 wrote to memory of 3868	2544	powershell.exe	99
PID 2544 wrote to memory of 4964	2544	powershell.exe	101
PID 5208 wrote to memory of 400	5208	cmd.exe	103
PID 3996 wrote to memory of 5196	3996	cmd.exe	104
PID 1684 wrote to memory of 4692	1684	cmd.exe	105
PID 1220 wrote to memory of 3560	1220	cmd.exe	106
PID 816 wrote to memory of 3256	816	cmd.exe	107
PID 5180 wrote to memory of 3092	5180	cmd.exe	286
PID 3868 wrote to memory of 3292	3868	cmd.exe	109
PID 900 wrote to memory of 3664	900	cmd.exe	110
PID 900 wrote to memory of 2272	900	cmd.exe	111
PID 5208 wrote to memory of 3096	5208	cmd.exe	112
PID 1220 wrote to memory of 3484	1220	cmd.exe	289
PID 3996 wrote to memory of 5908	3996	cmd.exe	114
PID 1684 wrote to memory of 2888	1684	cmd.exe	205
PID 5180 wrote to memory of 404	5180	cmd.exe	293
PID 816 wrote to memory of 4100	816	cmd.exe	117
PID 3868 wrote to memory of 5972	3868	cmd.exe	118
PID 900 wrote to memory of 2588	900	cmd.exe	119
PID 1220 wrote to memory of 2296	1220	cmd.exe	120
PID 5208 wrote to memory of 2828	5208	cmd.exe	299

C:\Users\Admin\AppData\Local\Temp\random.exe
"C:\Users\Admin\AppData\Local\Temp\random.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:4888
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell.exe" -NoProfile -ExecutionPolicy Bypass -File C:\Users\Admin\AppData\Local\Temp\PrankSim_2c84c9a62ff44c1d992c751f9a7d5def\RunPrankCore.ps1
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:2544
- - C:\Windows\system32\cmd.exe
    "C:\Windows\system32\cmd.exe" /k title FAKEVIR_1& color 0A & for /L %z in (0,0,1) do (echo [W32.Dropper.1] segment=%RANDOM% heuristic=GEN:FAKE & echo [TROJAN] packed payload -- NOT REAL -- & echo [ADWARE] cookie_stealer_sim.dll & ping -n 1 127.0.0.1 > nul)
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:1220
  - - C:\Windows\system32\PING.EXE
      ping -n 1 127.0.0.1
      4⤵
      PID:3560
  - - C:\Windows\system32\PING.EXE
      ping -n 1 127.0.0.1
      4⤵
      PID:3484
  - - C:\Windows\system32\PING.EXE
      ping -n 1 127.0.0.1
      4⤵
      PID:2296
  - - C:\Windows\system32\PING.EXE
      ping -n 1 127.0.0.1
      4⤵
      PID:2832
  - - C:\Windows\system32\PING.EXE
      ping -n 1 127.0.0.1
      4⤵
      PID:1416
  - - C:\Windows\system32\PING.EXE
      ping -n 1 127.0.0.1
      4⤵
      System Network Configuration Discovery: Internet Connection Discovery
      PID:228
  - - C:\Windows\system32\PING.EXE
      ping -n 1 127.0.0.1
      4⤵
      PID:3324
  - - C:\Windows\system32\PING.EXE
      ping -n 1 127.0.0.1
      4⤵
      System Network Configuration Discovery: Internet Connection Discovery
      PID:6016
  - - C:\Windows\system32\PING.EXE
      ping -n 1 127.0.0.1
      4⤵
      PID:5956
  - - C:\Windows\system32\PING.EXE
      ping -n 1 127.0.0.1
      4⤵
      System Network Configuration Discovery: Internet Connection Discovery
      PID:4420
  - - C:\Windows\system32\PING.EXE
      ping -n 1 127.0.0.1
      4⤵
      System Network Configuration Discovery: Internet Connection Discovery
      PID:5044
  - - C:\Windows\system32\PING.EXE
      ping -n 1 127.0.0.1
      4⤵
      Runs ping.exe
      PID:2488
  - - C:\Windows\system32\PING.EXE
      ping -n 1 127.0.0.1
      4⤵
      PID:8
  - - C:\Windows\system32\PING.EXE
      ping -n 1 127.0.0.1
      4⤵
      PID:3396
  - - C:\Windows\system32\PING.EXE
      ping -n 1 127.0.0.1
      4⤵
      Runs ping.exe
      PID:2636
  - - C:\Windows\system32\PING.EXE
      ping -n 1 127.0.0.1
      4⤵
      PID:3436
  - - C:\Windows\system32\PING.EXE
      ping -n 1 127.0.0.1
      4⤵
      Runs ping.exe
      PID:5916
  - - C:\Windows\system32\PING.EXE
      ping -n 1 127.0.0.1
      4⤵
      System Network Configuration Discovery: Internet Connection Discovery
      PID:2928
  - - C:\Windows\system32\PING.EXE
      ping -n 1 127.0.0.1
      4⤵
      PID:1556
  - - C:\Windows\system32\PING.EXE
      ping -n 1 127.0.0.1
      4⤵
      Runs ping.exe
      PID:3108
  - - C:\Windows\system32\PING.EXE
      ping -n 1 127.0.0.1
      4⤵
      System Network Configuration Discovery: Internet Connection Discovery
      PID:4548
  - - C:\Windows\system32\PING.EXE
      ping -n 1 127.0.0.1
      4⤵
      PID:4300
  - - C:\Windows\system32\PING.EXE
      ping -n 1 127.0.0.1
      4⤵
      System Network Configuration Discovery: Internet Connection Discovery
      PID:5048
  - - C:\Windows\system32\PING.EXE
      ping -n 1 127.0.0.1
      4⤵
      Runs ping.exe
      PID:4688
  - - C:\Windows\system32\PING.EXE
      ping -n 1 127.0.0.1
      4⤵
      Runs ping.exe
      PID:1036
  - - C:\Windows\system32\PING.EXE
      ping -n 1 127.0.0.1
      4⤵
      PID:1128
  - - C:\Windows\system32\PING.EXE
      ping -n 1 127.0.0.1
      4⤵
      PID:1240
  - - C:\Windows\system32\PING.EXE
      ping -n 1 127.0.0.1
      4⤵
      Runs ping.exe
      PID:328
  - - C:\Windows\system32\PING.EXE
      ping -n 1 127.0.0.1
      4⤵
      Runs ping.exe
      PID:4520
  - - C:\Windows\system32\PING.EXE
      ping -n 1 127.0.0.1
      4⤵
      PID:3196
  - - C:\Windows\system32\PING.EXE
      ping -n 1 127.0.0.1
      4⤵
      PID:4612
  - - C:\Windows\system32\PING.EXE
      ping -n 1 127.0.0.1
      4⤵
      PID:4420
  - - C:\Windows\system32\PING.EXE
      ping -n 1 127.0.0.1
      4⤵
      Runs ping.exe
      PID:5072
  - - C:\Windows\system32\PING.EXE
      ping -n 1 127.0.0.1
      4⤵
      Runs ping.exe
      PID:6000
  - - C:\Windows\system32\PING.EXE
      ping -n 1 127.0.0.1
      4⤵
      System Network Configuration Discovery: Internet Connection Discovery
      PID:3364
  - - C:\Windows\system32\PING.EXE
      ping -n 1 127.0.0.1
      4⤵
      PID:5772
  - - C:\Windows\system32\PING.EXE
      ping -n 1 127.0.0.1
      4⤵
      PID:5728
- - C:\Windows\system32\cmd.exe
    "C:\Windows\system32\cmd.exe" /k title FAKEVIR_2& color 0A & for /L %z in (0,0,1) do (echo [W32.Dropper.2] segment=%RANDOM% heuristic=GEN:FAKE & echo [TROJAN] packed payload -- NOT REAL -- & echo [ADWARE] cookie_stealer_sim.dll & ping -n 1 127.0.0.1 > nul)
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:5208
  - - C:\Windows\system32\PING.EXE
      ping -n 1 127.0.0.1
      4⤵
      PID:400
  - - C:\Windows\system32\PING.EXE
      ping -n 1 127.0.0.1
      4⤵
      Runs ping.exe
      PID:3096
  - - C:\Windows\system32\PING.EXE
      ping -n 1 127.0.0.1
      4⤵
      PID:2828
  - - C:\Windows\system32\PING.EXE
      ping -n 1 127.0.0.1
      4⤵
      Runs ping.exe
      PID:1480
  - - C:\Windows\system32\PING.EXE
      ping -n 1 127.0.0.1
      4⤵
      PID:4204
  - - C:\Windows\system32\PING.EXE
      ping -n 1 127.0.0.1
      4⤵
      PID:1768
  - - C:\Windows\system32\PING.EXE
      ping -n 1 127.0.0.1
      4⤵
      Runs ping.exe
      PID:3668
  - - C:\Windows\system32\PING.EXE
      ping -n 1 127.0.0.1
      4⤵
      Runs ping.exe
      PID:4512
  - - C:\Windows\system32\PING.EXE
      ping -n 1 127.0.0.1
      4⤵
      Runs ping.exe
      PID:3520
  - - C:\Windows\system32\PING.EXE
      ping -n 1 127.0.0.1
      4⤵
      PID:2604
  - - C:\Windows\system32\PING.EXE
      ping -n 1 127.0.0.1
      4⤵
      PID:4104
  - - C:\Windows\system32\PING.EXE
      ping -n 1 127.0.0.1
      4⤵
      PID:3404
  - - C:\Windows\system32\PING.EXE
      ping -n 1 127.0.0.1
      4⤵
      PID:3244
  - - C:\Windows\system32\PING.EXE
      ping -n 1 127.0.0.1
      4⤵
      Runs ping.exe
      PID:5184
  - - C:\Windows\system32\PING.EXE
      ping -n 1 127.0.0.1
      4⤵
      PID:4020
  - - C:\Windows\system32\PING.EXE
      ping -n 1 127.0.0.1
      4⤵
      PID:1432
  - - C:\Windows\system32\PING.EXE
      ping -n 1 127.0.0.1
      4⤵
      Runs ping.exe
      PID:5516
  - - C:\Windows\system32\PING.EXE
      ping -n 1 127.0.0.1
      4⤵
      PID:5360
  - - C:\Windows\system32\PING.EXE
      ping -n 1 127.0.0.1
      4⤵
      System Network Configuration Discovery: Internet Connection Discovery
      PID:5624
  - - C:\Windows\system32\PING.EXE
      ping -n 1 127.0.0.1
      4⤵
      PID:3760
  - - C:\Windows\system32\PING.EXE
      ping -n 1 127.0.0.1
      4⤵
      PID:5124
  - - C:\Windows\system32\PING.EXE
      ping -n 1 127.0.0.1
      4⤵
      PID:8
  - - C:\Windows\system32\PING.EXE
      ping -n 1 127.0.0.1
      4⤵
      PID:4664
  - - C:\Windows\system32\PING.EXE
      ping -n 1 127.0.0.1
      4⤵
      PID:424
  - - C:\Windows\system32\PING.EXE
      ping -n 1 127.0.0.1
      4⤵
      PID:3580
  - - C:\Windows\system32\PING.EXE
      ping -n 1 127.0.0.1
      4⤵
      Runs ping.exe
      PID:5204
  - - C:\Windows\system32\PING.EXE
      ping -n 1 127.0.0.1
      4⤵
      PID:1444
  - - C:\Windows\system32\PING.EXE
      ping -n 1 127.0.0.1
      4⤵
      PID:3136
  - - C:\Windows\system32\PING.EXE
      ping -n 1 127.0.0.1
      4⤵
      PID:3108
  - - C:\Windows\system32\PING.EXE
      ping -n 1 127.0.0.1
      4⤵
      System Network Configuration Discovery: Internet Connection Discovery
      PID:4620
  - - C:\Windows\system32\PING.EXE
      ping -n 1 127.0.0.1
      4⤵
      PID:3524
  - - C:\Windows\system32\PING.EXE
      ping -n 1 127.0.0.1
      4⤵
      PID:820
  - - C:\Windows\system32\PING.EXE
      ping -n 1 127.0.0.1
      4⤵
      PID:3272
  - - C:\Windows\system32\PING.EXE
      ping -n 1 127.0.0.1
      4⤵
      PID:2420
  - - C:\Windows\system32\PING.EXE
      ping -n 1 127.0.0.1
      4⤵
      PID:1260
- - C:\Windows\system32\cmd.exe
    "C:\Windows\system32\cmd.exe" /k title FAKEVIR_3& color 0A & for /L %z in (0,0,1) do (echo [W32.Dropper.3] segment=%RANDOM% heuristic=GEN:FAKE & echo [TROJAN] packed payload -- NOT REAL -- & echo [ADWARE] cookie_stealer_sim.dll & ping -n 1 127.0.0.1 > nul)
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:3996
  - - C:\Windows\system32\PING.EXE
      ping -n 1 127.0.0.1
      4⤵
      System Network Configuration Discovery: Internet Connection Discovery
      PID:5196
  - - C:\Windows\system32\PING.EXE
      ping -n 1 127.0.0.1
      4⤵
      PID:5908
  - - C:\Windows\system32\PING.EXE
      ping -n 1 127.0.0.1
      4⤵
      PID:3204
  - - C:\Windows\system32\PING.EXE
      ping -n 1 127.0.0.1
      4⤵
      Runs ping.exe
      PID:5400
  - - C:\Windows\system32\PING.EXE
      ping -n 1 127.0.0.1
      4⤵
      Runs ping.exe
      PID:1528
  - - C:\Windows\system32\PING.EXE
      ping -n 1 127.0.0.1
      4⤵
      PID:3196
  - - C:\Windows\system32\PING.EXE
      ping -n 1 127.0.0.1
      4⤵
      Runs ping.exe
      PID:1888
  - - C:\Windows\system32\PING.EXE
      ping -n 1 127.0.0.1
      4⤵
      PID:4960
  - - C:\Windows\system32\PING.EXE
      ping -n 1 127.0.0.1
      4⤵
      System Network Configuration Discovery: Internet Connection Discovery
      PID:5072
  - - C:\Windows\system32\PING.EXE
      ping -n 1 127.0.0.1
      4⤵
      PID:5112
  - - C:\Windows\system32\PING.EXE
      ping -n 1 127.0.0.1
      4⤵
      PID:3992
  - - C:\Windows\system32\PING.EXE
      ping -n 1 127.0.0.1
      4⤵
      PID:1072
  - - C:\Windows\system32\PING.EXE
      ping -n 1 127.0.0.1
      4⤵
      PID:5648
  - - C:\Windows\system32\PING.EXE
      ping -n 1 127.0.0.1
      4⤵
      PID:2548
  - - C:\Windows\system32\PING.EXE
      ping -n 1 127.0.0.1
      4⤵
      PID:2756
  - - C:\Windows\system32\PING.EXE
      ping -n 1 127.0.0.1
      4⤵
      System Network Configuration Discovery: Internet Connection Discovery
      PID:5556
  - - C:\Windows\system32\PING.EXE
      ping -n 1 127.0.0.1
      4⤵
      Runs ping.exe
      PID:2692
  - - C:\Windows\system32\PING.EXE
      ping -n 1 127.0.0.1
      4⤵
      PID:4744
  - - C:\Windows\system32\PING.EXE
      ping -n 1 127.0.0.1
      4⤵
      PID:4420
  - - C:\Windows\system32\PING.EXE
      ping -n 1 127.0.0.1
      4⤵
      PID:5552
  - - C:\Windows\system32\PING.EXE
      ping -n 1 127.0.0.1
      4⤵
      Runs ping.exe
      PID:3328
  - - C:\Windows\system32\PING.EXE
      ping -n 1 127.0.0.1
      4⤵
      PID:3992
  - - C:\Windows\system32\PING.EXE
      ping -n 1 127.0.0.1
      4⤵
      Runs ping.exe
      PID:5764
  - - C:\Windows\system32\PING.EXE
      ping -n 1 127.0.0.1
      4⤵
      Runs ping.exe
      PID:2828
  - - C:\Windows\system32\PING.EXE
      ping -n 1 127.0.0.1
      4⤵
      PID:3204
  - - C:\Windows\system32\PING.EXE
      ping -n 1 127.0.0.1
      4⤵
      System Network Configuration Discovery: Internet Connection Discovery
      PID:3436
  - - C:\Windows\system32\PING.EXE
      ping -n 1 127.0.0.1
      4⤵
      PID:2204
  - - C:\Windows\system32\PING.EXE
      ping -n 1 127.0.0.1
      4⤵
      PID:2020
  - - C:\Windows\system32\PING.EXE
      ping -n 1 127.0.0.1
      4⤵
      PID:1224
  - - C:\Windows\system32\PING.EXE
      ping -n 1 127.0.0.1
      4⤵
      System Network Configuration Discovery: Internet Connection Discovery
      PID:4916
  - - C:\Windows\system32\PING.EXE
      ping -n 1 127.0.0.1
      4⤵
      PID:4948
  - - C:\Windows\system32\PING.EXE
      ping -n 1 127.0.0.1
      4⤵
      PID:5112
  - - C:\Windows\system32\PING.EXE
      ping -n 1 127.0.0.1
      4⤵
      PID:4104
  - - C:\Windows\system32\PING.EXE
      ping -n 1 127.0.0.1
      4⤵
      PID:3432
  - - C:\Windows\system32\PING.EXE
      ping -n 1 127.0.0.1
      4⤵
      PID:1164
- - C:\Windows\system32\cmd.exe
    "C:\Windows\system32\cmd.exe" /k title FAKEVIR_4& color 0A & for /L %z in (0,0,1) do (echo [W32.Dropper.4] segment=%RANDOM% heuristic=GEN:FAKE & echo [TROJAN] packed payload -- NOT REAL -- & echo [ADWARE] cookie_stealer_sim.dll & ping -n 1 127.0.0.1 > nul)
    3⤵
    - System Network Configuration Discovery: Internet Connection Discovery
    - Suspicious use of WriteProcessMemory
    PID:900
  - - C:\Windows\system32\PING.EXE
      ping -n 1 127.0.0.1
      4⤵
      PID:3664
  - - C:\Windows\system32\PING.EXE
      ping -n 1 127.0.0.1
      4⤵
      PID:2272
  - - C:\Windows\system32\PING.EXE
      ping -n 1 127.0.0.1
      4⤵
      PID:2588
  - - C:\Windows\system32\PING.EXE
      ping -n 1 127.0.0.1
      4⤵
      Runs ping.exe
      PID:2808
  - - C:\Windows\system32\PING.EXE
      ping -n 1 127.0.0.1
      4⤵
      PID:5264
  - - C:\Windows\system32\PING.EXE
      ping -n 1 127.0.0.1
      4⤵
      PID:1444
  - - C:\Windows\system32\PING.EXE
      ping -n 1 127.0.0.1
      4⤵
      PID:6048
  - - C:\Windows\system32\PING.EXE
      ping -n 1 127.0.0.1
      4⤵
      PID:5528
  - - C:\Windows\system32\PING.EXE
      ping -n 1 127.0.0.1
      4⤵
      PID:1264
  - - C:\Windows\system32\PING.EXE
      ping -n 1 127.0.0.1
      4⤵
      PID:5084
  - - C:\Windows\system32\PING.EXE
      ping -n 1 127.0.0.1
      4⤵
      PID:3408
  - - C:\Windows\system32\PING.EXE
      ping -n 1 127.0.0.1
      4⤵
      PID:4836
  - - C:\Windows\system32\PING.EXE
      ping -n 1 127.0.0.1
      4⤵
      PID:2852
  - - C:\Windows\system32\PING.EXE
      ping -n 1 127.0.0.1
      4⤵
      PID:2356
  - - C:\Windows\system32\PING.EXE
      ping -n 1 127.0.0.1
      4⤵
      Runs ping.exe
      PID:2808
  - - C:\Windows\system32\PING.EXE
      ping -n 1 127.0.0.1
      4⤵
      PID:116
  - - C:\Windows\system32\PING.EXE
      ping -n 1 127.0.0.1
      4⤵
      Runs ping.exe
      PID:1484
  - - C:\Windows\system32\PING.EXE
      ping -n 1 127.0.0.1
      4⤵
      System Network Configuration Discovery: Internet Connection Discovery
      PID:3964
  - - C:\Windows\system32\PING.EXE
      ping -n 1 127.0.0.1
      4⤵
      System Network Configuration Discovery: Internet Connection Discovery
      Runs ping.exe
      PID:1224
  - - C:\Windows\system32\PING.EXE
      ping -n 1 127.0.0.1
      4⤵
      PID:4328
  - - C:\Windows\system32\PING.EXE
      ping -n 1 127.0.0.1
      4⤵
      PID:4988
  - - C:\Windows\system32\PING.EXE
      ping -n 1 127.0.0.1
      4⤵
      PID:6044
  - - C:\Windows\system32\PING.EXE
      ping -n 1 127.0.0.1
      4⤵
      Runs ping.exe
      PID:5436
  - - C:\Windows\system32\PING.EXE
      ping -n 1 127.0.0.1
      4⤵
      PID:3092
  - - C:\Windows\system32\PING.EXE
      ping -n 1 127.0.0.1
      4⤵
      PID:552
  - - C:\Windows\system32\PING.EXE
      ping -n 1 127.0.0.1
      4⤵
      Runs ping.exe
      PID:5272
  - - C:\Windows\system32\PING.EXE
      ping -n 1 127.0.0.1
      4⤵
      System Network Configuration Discovery: Internet Connection Discovery
      PID:5276
  - - C:\Windows\system32\PING.EXE
      ping -n 1 127.0.0.1
      4⤵
      System Network Configuration Discovery: Internet Connection Discovery
      PID:2556
  - - C:\Windows\system32\PING.EXE
      ping -n 1 127.0.0.1
      4⤵
      Runs ping.exe
      PID:4536
  - - C:\Windows\system32\PING.EXE
      ping -n 1 127.0.0.1
      4⤵
      PID:5024
  - - C:\Windows\system32\PING.EXE
      ping -n 1 127.0.0.1
      4⤵
      System Network Configuration Discovery: Internet Connection Discovery
      PID:4368
  - - C:\Windows\system32\PING.EXE
      ping -n 1 127.0.0.1
      4⤵
      PID:4960
  - - C:\Windows\system32\PING.EXE
      ping -n 1 127.0.0.1
      4⤵
      PID:4900
  - - C:\Windows\system32\PING.EXE
      ping -n 1 127.0.0.1
      4⤵
      PID:5436
  - - C:\Windows\system32\PING.EXE
      ping -n 1 127.0.0.1
      4⤵
      PID:3392
  - - C:\Windows\system32\PING.EXE
      ping -n 1 127.0.0.1
      4⤵
      PID:2852
  - - C:\Windows\system32\PING.EXE
      ping -n 1 127.0.0.1
      4⤵
      PID:3116
- - C:\Windows\system32\cmd.exe
    "C:\Windows\system32\cmd.exe" /k title FAKEVIR_5& color 0A & for /L %z in (0,0,1) do (echo [W32.Dropper.5] segment=%RANDOM% heuristic=GEN:FAKE & echo [TROJAN] packed payload -- NOT REAL -- & echo [ADWARE] cookie_stealer_sim.dll & ping -n 1 127.0.0.1 > nul)
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:816
  - - C:\Windows\system32\PING.EXE
      ping -n 1 127.0.0.1
      4⤵
      System Network Configuration Discovery: Internet Connection Discovery
      PID:3256
  - - C:\Windows\system32\PING.EXE
      ping -n 1 127.0.0.1
      4⤵
      PID:4100
  - - C:\Windows\system32\PING.EXE
      ping -n 1 127.0.0.1
      4⤵
      System Network Configuration Discovery: Internet Connection Discovery
      Runs ping.exe
      PID:5676
  - - C:\Windows\system32\PING.EXE
      ping -n 1 127.0.0.1
      4⤵
      PID:5200
  - - C:\Windows\system32\PING.EXE
      ping -n 1 127.0.0.1
      4⤵
      PID:3152
  - - C:\Windows\system32\PING.EXE
      ping -n 1 127.0.0.1
      4⤵
      PID:5584
  - - C:\Windows\system32\PING.EXE
      ping -n 1 127.0.0.1
      4⤵
      PID:3624
  - - C:\Windows\system32\PING.EXE
      ping -n 1 127.0.0.1
      4⤵
      PID:2028
  - - C:\Windows\system32\PING.EXE
      ping -n 1 127.0.0.1
      4⤵
      PID:5060
  - - C:\Windows\system32\PING.EXE
      ping -n 1 127.0.0.1
      4⤵
      PID:468
  - - C:\Windows\system32\PING.EXE
      ping -n 1 127.0.0.1
      4⤵
      System Network Configuration Discovery: Internet Connection Discovery
      PID:5740
  - - C:\Windows\system32\PING.EXE
      ping -n 1 127.0.0.1
      4⤵
      Runs ping.exe
      PID:5640
  - - C:\Windows\system32\PING.EXE
      ping -n 1 127.0.0.1
      4⤵
      PID:448
  - - C:\Windows\system32\PING.EXE
      ping -n 1 127.0.0.1
      4⤵
      PID:4256
  - - C:\Windows\system32\PING.EXE
      ping -n 1 127.0.0.1
      4⤵
      Runs ping.exe
      PID:568
  - - C:\Windows\system32\PING.EXE
      ping -n 1 127.0.0.1
      4⤵
      Runs ping.exe
      PID:5356
  - - C:\Windows\system32\PING.EXE
      ping -n 1 127.0.0.1
      4⤵
      PID:2232
  - - C:\Windows\system32\PING.EXE
      ping -n 1 127.0.0.1
      4⤵
      PID:3620
  - - C:\Windows\system32\PING.EXE
      ping -n 1 127.0.0.1
      4⤵
      PID:5528
  - - C:\Windows\system32\PING.EXE
      ping -n 1 127.0.0.1
      4⤵
      Runs ping.exe
      PID:3704
  - - C:\Windows\system32\PING.EXE
      ping -n 1 127.0.0.1
      4⤵
      System Network Configuration Discovery: Internet Connection Discovery
      PID:4644
  - - C:\Windows\system32\PING.EXE
      ping -n 1 127.0.0.1
      4⤵
      PID:3820
  - - C:\Windows\system32\PING.EXE
      ping -n 1 127.0.0.1
      4⤵
      System Network Configuration Discovery: Internet Connection Discovery
      PID:5428
  - - C:\Windows\system32\PING.EXE
      ping -n 1 127.0.0.1
      4⤵
      PID:3260
  - - C:\Windows\system32\PING.EXE
      ping -n 1 127.0.0.1
      4⤵
      System Network Configuration Discovery: Internet Connection Discovery
      PID:404
  - - C:\Windows\system32\PING.EXE
      ping -n 1 127.0.0.1
      4⤵
      PID:4084
  - - C:\Windows\system32\PING.EXE
      ping -n 1 127.0.0.1
      4⤵
      PID:3656
  - - C:\Windows\system32\PING.EXE
      ping -n 1 127.0.0.1
      4⤵
      PID:5608
  - - C:\Windows\system32\PING.EXE
      ping -n 1 127.0.0.1
      4⤵
      PID:1356
  - - C:\Windows\system32\PING.EXE
      ping -n 1 127.0.0.1
      4⤵
      PID:6100
  - - C:\Windows\system32\PING.EXE
      ping -n 1 127.0.0.1
      4⤵
      PID:4304
  - - C:\Windows\system32\PING.EXE
      ping -n 1 127.0.0.1
      4⤵
      System Network Configuration Discovery: Internet Connection Discovery
      PID:1160
  - - C:\Windows\system32\PING.EXE
      ping -n 1 127.0.0.1
      4⤵
      PID:468
  - - C:\Windows\system32\PING.EXE
      ping -n 1 127.0.0.1
      4⤵
      PID:5124
  - - C:\Windows\system32\PING.EXE
      ping -n 1 127.0.0.1
      4⤵
      PID:3992
  - - C:\Windows\system32\PING.EXE
      ping -n 1 127.0.0.1
      4⤵
      PID:5908
  - - C:\Windows\system32\PING.EXE
      ping -n 1 127.0.0.1
      4⤵
      System Network Configuration Discovery: Internet Connection Discovery
      PID:2588
- - C:\Windows\system32\cmd.exe
    "C:\Windows\system32\cmd.exe" /k title FAKEVIR_6& color 0A & for /L %z in (0,0,1) do (echo [W32.Dropper.6] segment=%RANDOM% heuristic=GEN:FAKE & echo [TROJAN] packed payload -- NOT REAL -- & echo [ADWARE] cookie_stealer_sim.dll & ping -n 1 127.0.0.1 > nul)
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:1684
  - - C:\Windows\system32\PING.EXE
      ping -n 1 127.0.0.1
      4⤵
      PID:4692
  - - C:\Windows\system32\PING.EXE
      ping -n 1 127.0.0.1
      4⤵
      PID:2888
  - - C:\Windows\system32\PING.EXE
      ping -n 1 127.0.0.1
      4⤵
      PID:2548
  - - C:\Windows\system32\PING.EXE
      ping -n 1 127.0.0.1
      4⤵
      Runs ping.exe
      PID:3552
  - - C:\Windows\system32\PING.EXE
      ping -n 1 127.0.0.1
      4⤵
      PID:5560
  - - C:\Windows\system32\PING.EXE
      ping -n 1 127.0.0.1
      4⤵
      PID:5440
  - - C:\Windows\system32\PING.EXE
      ping -n 1 127.0.0.1
      4⤵
      Runs ping.exe
      PID:4292
  - - C:\Windows\system32\PING.EXE
      ping -n 1 127.0.0.1
      4⤵
      PID:4376
  - - C:\Windows\system32\PING.EXE
      ping -n 1 127.0.0.1
      4⤵
      System Network Configuration Discovery: Internet Connection Discovery
      PID:4708
  - - C:\Windows\system32\PING.EXE
      ping -n 1 127.0.0.1
      4⤵
      Runs ping.exe
      PID:5404
  - - C:\Windows\system32\PING.EXE
      ping -n 1 127.0.0.1
      4⤵
      System Network Configuration Discovery: Internet Connection Discovery
      PID:3232
  - - C:\Windows\system32\PING.EXE
      ping -n 1 127.0.0.1
      4⤵
      PID:64
  - - C:\Windows\system32\PING.EXE
      ping -n 1 127.0.0.1
      4⤵
      PID:2752
  - - C:\Windows\system32\PING.EXE
      ping -n 1 127.0.0.1
      4⤵
      Runs ping.exe
      PID:5992
  - - C:\Windows\system32\PING.EXE
      ping -n 1 127.0.0.1
      4⤵
      PID:1828
  - - C:\Windows\system32\PING.EXE
      ping -n 1 127.0.0.1
      4⤵
      PID:3660
  - - C:\Windows\system32\PING.EXE
      ping -n 1 127.0.0.1
      4⤵
      PID:3624
  - - C:\Windows\system32\PING.EXE
      ping -n 1 127.0.0.1
      4⤵
      PID:4568
  - - C:\Windows\system32\PING.EXE
      ping -n 1 127.0.0.1
      4⤵
      PID:4736
  - - C:\Windows\system32\PING.EXE
      ping -n 1 127.0.0.1
      4⤵
      PID:1660
  - - C:\Windows\system32\PING.EXE
      ping -n 1 127.0.0.1
      4⤵
      Runs ping.exe
      PID:820
  - - C:\Windows\system32\PING.EXE
      ping -n 1 127.0.0.1
      4⤵
      System Network Configuration Discovery: Internet Connection Discovery
      PID:1664
  - - C:\Windows\system32\PING.EXE
      ping -n 1 127.0.0.1
      4⤵
      PID:3424
  - - C:\Windows\system32\PING.EXE
      ping -n 1 127.0.0.1
      4⤵
      PID:3116
  - - C:\Windows\system32\PING.EXE
      ping -n 1 127.0.0.1
      4⤵
      System Network Configuration Discovery: Internet Connection Discovery
      PID:320
  - - C:\Windows\system32\PING.EXE
      ping -n 1 127.0.0.1
      4⤵
      PID:2052
  - - C:\Windows\system32\PING.EXE
      ping -n 1 127.0.0.1
      4⤵
      PID:3388
  - - C:\Windows\system32\PING.EXE
      ping -n 1 127.0.0.1
      4⤵
      PID:5628
  - - C:\Windows\system32\PING.EXE
      ping -n 1 127.0.0.1
      4⤵
      System Network Configuration Discovery: Internet Connection Discovery
      Runs ping.exe
      PID:5620
  - - C:\Windows\system32\PING.EXE
      ping -n 1 127.0.0.1
      4⤵
      System Network Configuration Discovery: Internet Connection Discovery
      Runs ping.exe
      PID:4328
  - - C:\Windows\system32\PING.EXE
      ping -n 1 127.0.0.1
      4⤵
      System Network Configuration Discovery: Internet Connection Discovery
      PID:4708
  - - C:\Windows\system32\PING.EXE
      ping -n 1 127.0.0.1
      4⤵
      Runs ping.exe
      PID:5524
  - - C:\Windows\system32\PING.EXE
      ping -n 1 127.0.0.1
      4⤵
      Runs ping.exe
      PID:3396
  - - C:\Windows\system32\PING.EXE
      ping -n 1 127.0.0.1
      4⤵
      PID:3792
  - - C:\Windows\system32\PING.EXE
      ping -n 1 127.0.0.1
      4⤵
      System Network Configuration Discovery: Internet Connection Discovery
      PID:424
- - C:\Windows\system32\cmd.exe
    "C:\Windows\system32\cmd.exe" /k title FAKEVIR_7& color 0A & for /L %z in (0,0,1) do (echo [W32.Dropper.7] segment=%RANDOM% heuristic=GEN:FAKE & echo [TROJAN] packed payload -- NOT REAL -- & echo [ADWARE] cookie_stealer_sim.dll & ping -n 1 127.0.0.1 > nul)
    3⤵
    - System Network Configuration Discovery: Internet Connection Discovery
    - Suspicious use of WriteProcessMemory
    PID:5180
  - - C:\Windows\system32\PING.EXE
      ping -n 1 127.0.0.1
      4⤵
      PID:3092
  - - C:\Windows\system32\PING.EXE
      ping -n 1 127.0.0.1
      4⤵
      PID:404
  - - C:\Windows\system32\PING.EXE
      ping -n 1 127.0.0.1
      4⤵
      PID:5992
  - - C:\Windows\system32\PING.EXE
      ping -n 1 127.0.0.1
      4⤵
      PID:5680
  - - C:\Windows\system32\PING.EXE
      ping -n 1 127.0.0.1
      4⤵
      PID:2556
  - - C:\Windows\system32\PING.EXE
      ping -n 1 127.0.0.1
      4⤵
      PID:4860
  - - C:\Windows\system32\PING.EXE
      ping -n 1 127.0.0.1
      4⤵
      Runs ping.exe
      PID:2364
  - - C:\Windows\system32\PING.EXE
      ping -n 1 127.0.0.1
      4⤵
      PID:2664
  - - C:\Windows\system32\PING.EXE
      ping -n 1 127.0.0.1
      4⤵
      System Network Configuration Discovery: Internet Connection Discovery
      PID:904
  - - C:\Windows\system32\PING.EXE
      ping -n 1 127.0.0.1
      4⤵
      System Network Configuration Discovery: Internet Connection Discovery
      PID:5160
  - - C:\Windows\system32\PING.EXE
      ping -n 1 127.0.0.1
      4⤵
      System Network Configuration Discovery: Internet Connection Discovery
      Runs ping.exe
      PID:1568
  - - C:\Windows\system32\PING.EXE
      ping -n 1 127.0.0.1
      4⤵
      System Network Configuration Discovery: Internet Connection Discovery
      PID:728
  - - C:\Windows\system32\PING.EXE
      ping -n 1 127.0.0.1
      4⤵
      System Network Configuration Discovery: Internet Connection Discovery
      PID:2784
  - - C:\Windows\system32\PING.EXE
      ping -n 1 127.0.0.1
      4⤵
      Runs ping.exe
      PID:4152
  - - C:\Windows\system32\PING.EXE
      ping -n 1 127.0.0.1
      4⤵
      PID:3048
  - - C:\Windows\system32\PING.EXE
      ping -n 1 127.0.0.1
      4⤵
      Runs ping.exe
      PID:5680
  - - C:\Windows\system32\PING.EXE
      ping -n 1 127.0.0.1
      4⤵
      PID:920
  - - C:\Windows\system32\PING.EXE
      ping -n 1 127.0.0.1
      4⤵
      PID:2180
  - - C:\Windows\system32\PING.EXE
      ping -n 1 127.0.0.1
      4⤵
      PID:1856
  - - C:\Windows\system32\PING.EXE
      ping -n 1 127.0.0.1
      4⤵
      Runs ping.exe
      PID:4368
  - - C:\Windows\system32\PING.EXE
      ping -n 1 127.0.0.1
      4⤵
      PID:4948
  - - C:\Windows\system32\PING.EXE
      ping -n 1 127.0.0.1
      4⤵
      System Network Configuration Discovery: Internet Connection Discovery
      Runs ping.exe
      PID:3472
  - - C:\Windows\system32\PING.EXE
      ping -n 1 127.0.0.1
      4⤵
      System Network Configuration Discovery: Internet Connection Discovery
      PID:4692
  - - C:\Windows\system32\PING.EXE
      ping -n 1 127.0.0.1
      4⤵
      PID:1892
  - - C:\Windows\system32\PING.EXE
      ping -n 1 127.0.0.1
      4⤵
      PID:2832
  - - C:\Windows\system32\PING.EXE
      ping -n 1 127.0.0.1
      4⤵
      PID:2648
  - - C:\Windows\system32\PING.EXE
      ping -n 1 127.0.0.1
      4⤵
      PID:5508
  - - C:\Windows\system32\PING.EXE
      ping -n 1 127.0.0.1
      4⤵
      System Network Configuration Discovery: Internet Connection Discovery
      Runs ping.exe
      PID:4020
  - - C:\Windows\system32\PING.EXE
      ping -n 1 127.0.0.1
      4⤵
      PID:3864
  - - C:\Windows\system32\PING.EXE
      ping -n 1 127.0.0.1
      4⤵
      PID:5440
  - - C:\Windows\system32\PING.EXE
      ping -n 1 127.0.0.1
      4⤵
      PID:4728
  - - C:\Windows\system32\PING.EXE
      ping -n 1 127.0.0.1
      4⤵
      Runs ping.exe
      PID:2304
  - - C:\Windows\system32\PING.EXE
      ping -n 1 127.0.0.1
      4⤵
      System Network Configuration Discovery: Internet Connection Discovery
      PID:5284
  - - C:\Windows\system32\PING.EXE
      ping -n 1 127.0.0.1
      4⤵
      Runs ping.exe
      PID:4928
  - - C:\Windows\system32\PING.EXE
      ping -n 1 127.0.0.1
      4⤵
      PID:4836
  - - C:\Windows\system32\PING.EXE
      ping -n 1 127.0.0.1
      4⤵
      System Network Configuration Discovery: Internet Connection Discovery
      PID:2784
  - - C:\Windows\system32\PING.EXE
      ping -n 1 127.0.0.1
      4⤵
      PID:4440
- - C:\Windows\system32\cmd.exe
    "C:\Windows\system32\cmd.exe" /k title FAKEVIR_8& color 0A & for /L %z in (0,0,1) do (echo [W32.Dropper.8] segment=%RANDOM% heuristic=GEN:FAKE & echo [TROJAN] packed payload -- NOT REAL -- & echo [ADWARE] cookie_stealer_sim.dll & ping -n 1 127.0.0.1 > nul)
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:3868
  - - C:\Windows\system32\PING.EXE
      ping -n 1 127.0.0.1
      4⤵
      PID:3292
  - - C:\Windows\system32\PING.EXE
      ping -n 1 127.0.0.1
      4⤵
      System Network Configuration Discovery: Internet Connection Discovery
      PID:5972
  - - C:\Windows\system32\PING.EXE
      ping -n 1 127.0.0.1
      4⤵
      PID:1128
  - - C:\Windows\system32\PING.EXE
      ping -n 1 127.0.0.1
      4⤵
      Runs ping.exe
      PID:5188
  - - C:\Windows\system32\PING.EXE
      ping -n 1 127.0.0.1
      4⤵
      PID:5916
  - - C:\Windows\system32\PING.EXE
      ping -n 1 127.0.0.1
      4⤵
      PID:5556
  - - C:\Windows\system32\PING.EXE
      ping -n 1 127.0.0.1
      4⤵
      PID:2348
  - - C:\Windows\system32\PING.EXE
      ping -n 1 127.0.0.1
      4⤵
      System Network Configuration Discovery: Internet Connection Discovery
      PID:1576
  - - C:\Windows\system32\PING.EXE
      ping -n 1 127.0.0.1
      4⤵
      PID:4940
  - - C:\Windows\system32\PING.EXE
      ping -n 1 127.0.0.1
      4⤵
      Runs ping.exe
      PID:5668
  - - C:\Windows\system32\PING.EXE
      ping -n 1 127.0.0.1
      4⤵
      PID:6128
  - - C:\Windows\system32\PING.EXE
      ping -n 1 127.0.0.1
      4⤵
      System Network Configuration Discovery: Internet Connection Discovery
      Runs ping.exe
      PID:2472
  - - C:\Windows\system32\PING.EXE
      ping -n 1 127.0.0.1
      4⤵
      PID:6132
  - - C:\Windows\system32\PING.EXE
      ping -n 1 127.0.0.1
      4⤵
      System Network Configuration Discovery: Internet Connection Discovery
      PID:2888
  - - C:\Windows\system32\PING.EXE
      ping -n 1 127.0.0.1
      4⤵
      System Network Configuration Discovery: Internet Connection Discovery
      Runs ping.exe
      PID:3204
  - - C:\Windows\system32\PING.EXE
      ping -n 1 127.0.0.1
      4⤵
      System Network Configuration Discovery: Internet Connection Discovery
      Runs ping.exe
      PID:1480
  - - C:\Windows\system32\PING.EXE
      ping -n 1 127.0.0.1
      4⤵
      System Network Configuration Discovery: Internet Connection Discovery
      PID:2556
  - - C:\Windows\system32\PING.EXE
      ping -n 1 127.0.0.1
      4⤵
      System Network Configuration Discovery: Internet Connection Discovery
      PID:2360
  - - C:\Windows\system32\PING.EXE
      ping -n 1 127.0.0.1
      4⤵
      PID:4608
  - - C:\Windows\system32\PING.EXE
      ping -n 1 127.0.0.1
      4⤵
      PID:3084
  - - C:\Windows\system32\PING.EXE
      ping -n 1 127.0.0.1
      4⤵
      PID:5072
  - - C:\Windows\system32\PING.EXE
      ping -n 1 127.0.0.1
      4⤵
      System Network Configuration Discovery: Internet Connection Discovery
      PID:1592
  - - C:\Windows\system32\PING.EXE
      ping -n 1 127.0.0.1
      4⤵
      System Network Configuration Discovery: Internet Connection Discovery
      PID:3392
  - - C:\Windows\system32\PING.EXE
      ping -n 1 127.0.0.1
      4⤵
      System Network Configuration Discovery: Internet Connection Discovery
      PID:3484
  - - C:\Windows\system32\PING.EXE
      ping -n 1 127.0.0.1
      4⤵
      PID:3244
  - - C:\Windows\system32\PING.EXE
      ping -n 1 127.0.0.1
      4⤵
      Runs ping.exe
      PID:5572
  - - C:\Windows\system32\PING.EXE
      ping -n 1 127.0.0.1
      4⤵
      System Network Configuration Discovery: Internet Connection Discovery
      PID:1828
  - - C:\Windows\system32\PING.EXE
      ping -n 1 127.0.0.1
      4⤵
      Runs ping.exe
      PID:944
  - - C:\Windows\system32\PING.EXE
      ping -n 1 127.0.0.1
      4⤵
      System Network Configuration Discovery: Internet Connection Discovery
      PID:1748
  - - C:\Windows\system32\PING.EXE
      ping -n 1 127.0.0.1
      4⤵
      Runs ping.exe
      PID:2528
  - - C:\Windows\system32\PING.EXE
      ping -n 1 127.0.0.1
      4⤵
      PID:4540
  - - C:\Windows\system32\PING.EXE
      ping -n 1 127.0.0.1
      4⤵
      PID:1812
  - - C:\Windows\system32\PING.EXE
      ping -n 1 127.0.0.1
      4⤵
      PID:848
  - - C:\Windows\system32\PING.EXE
      ping -n 1 127.0.0.1
      4⤵
      System Network Configuration Discovery: Internet Connection Discovery
      PID:4692
  - - C:\Windows\system32\PING.EXE
      ping -n 1 127.0.0.1
      4⤵
      System Network Configuration Discovery: Internet Connection Discovery
      Runs ping.exe
      PID:2408
  - - C:\Windows\system32\PING.EXE
      ping -n 1 127.0.0.1
      4⤵
      System Network Configuration Discovery: Internet Connection Discovery
      PID:2412
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -NoProfile -ExecutionPolicy Bypass -File C:\Users\Admin\AppData\Local\Temp\PrankSim_2c84c9a62ff44c1d992c751f9a7d5def\ScaryConsole.ps1
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:4964

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Remote System Discovery

T1018

System Network Configuration Discovery

T1016

Internet Connection Discovery

T1016.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

RansomJoke.ps1

Path C:\Users\Admin\AppData\Local\Temp\PrankSim_2c84c9a62ff44c1d992c751f9a7d5def\RansomJoke.ps1
Size 13KB
SHA256 d5e50e83f5a46457f7fc1f8f51cd70be4019d85b8cfba488256e93e3ae50ee1e
MD5 e93c33f8561be2614babb8733ad5ba38
SHA1 3741a150a87b9be965630485f6f42aad35ceaf0f
SHA512 d78ee130d4675b2340e7412ccd1212770f64eb735769042e7d99cb8c4e74b4665807ec899e4033029447d6b8fd098ad12cc5179981aba3492206e6302f01b76f
SSDEEP 384:kgeXRwVJBkzMek0ok8cmWy8jkJ3uQcL9yjJ0B5TuHGovFg4wm/QN/NyEUOgO9OQe:1BN8otQNPUBO9OQkD
TLSH
T16B52933A2F1EC5260BB2560AC95FD9C5DE6A22372119DC2938FFD345FB55048A338A9C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

RunPrankCore.ps1

Path C:\Users\Admin\AppData\Local\Temp\PrankSim_2c84c9a62ff44c1d992c751f9a7d5def\RunPrankCore.ps1
Size 879B
SHA256 637e242d9cc4c834f9aa4a42ba85d2502c685d8e72cd1b6f44dd2ce29a4447a4
MD5 88bbd33bb9897f5b8fea04ba8afc2f46
SHA1 50d61608cb9cc4f47cc6f3602fcf094e005687df
SHA512 1ac2dfbc0e53d220a41b5d9c7ae12100b606150301ab137b5bd7e2e0986f957c6a8947cd619122eb22f90c66d7ad1bb5d8dff9698d8d7eef44abe04fd0fccdde
TLSH
T1B2116339BA2DE26480FCD82170FB8A337B3E903D80373D0179200A6C341266DE755C5C
MD5 SHA1 SHA512 TLSH

Submit Download

ScaryConsole.ps1

Path C:\Users\Admin\AppData\Local\Temp\PrankSim_2c84c9a62ff44c1d992c751f9a7d5def\ScaryConsole.ps1
Size 1KB
SHA256 fccf5cd2c5b625e7d01d05a30c837ae8107a1e1366390a408d92608699f460a5
MD5 c8ca3c47c5989c1224615ecff52edb62
SHA1 592cbee8d7ad3920c35c8678ee7c9411f271da4c
SHA512 cc47419f586c5ff233309f161fd5325bd9d1c562832b13fbfbb50b31673e76361f9747bcc602b4cd5a5b16a6b53fcb53993b9db3dad8b235fe997802efcfcde8
TLSH
T1B831B733D845003D837316EA84726108FD47593745769DDEF0BE815873C5628A363E62
MD5 SHA1 SHA512 TLSH

Submit Download

__PSScriptPolicyTest_efrlzhxt.5tu.ps1

Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_efrlzhxt.5tu.ps1
Size 60B
SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
MD5 d17fe0a3f47be24a6453e9ef58c94641
SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
TLSH
T177A02228CC303B200020C0080A000002C00B800C080C8C0220000A00B20B820002F080
MD5 SHA1 SHA512 TLSH

Submit Download

memory/2544-83-0x0000014B42580000-0x0000014B42590000-memory.dmp

Download

memory/2544-106-0x0000014B42580000-0x0000014B42590000-memory.dmp

Download

memory/2544-105-0x0000014B42580000-0x0000014B42590000-memory.dmp

Download

memory/2544-92-0x0000014B42580000-0x0000014B42590000-memory.dmp

Download

memory/2544-84-0x0000014B2A3B0000-0x0000014B2A3D2000-memory.dmp

Download

memory/2544-82-0x0000014B42580000-0x0000014B42590000-memory.dmp

Download

memory/4888-55-0x0000025063CE0000-0x0000025063CF0000-memory.dmp

Download

memory/4888-47-0x0000025065DB0000-0x0000025065F30000-memory.dmp

Download

memory/4888-21-0x0000025061E50000-0x0000025061E70000-memory.dmp

Download

memory/4888-17-0x0000025065750000-0x0000025065A30000-memory.dmp

Download

memory/4888-67-0x00000250683A0000-0x00000250683C0000-memory.dmp

Download

memory/4888-63-0x0000025065F50000-0x0000025065F80000-memory.dmp

Download

memory/4888-71-0x00000250694B0000-0x00000250694D0000-memory.dmp

Download

memory/4888-75-0x0000025068D60000-0x0000025068DB0000-memory.dmp

Download

memory/4888-43-0x0000025063C50000-0x0000025063C90000-memory.dmp

Download

memory/4888-25-0x0000025061ED0000-0x0000025061EF0000-memory.dmp

Download

memory/4888-51-0x0000025063C00000-0x0000025063C10000-memory.dmp

Download

memory/4888-5-0x0000025062C40000-0x00000250638D0000-memory.dmp

Download

memory/4888-59-0x0000025066B00000-0x0000025066BC0000-memory.dmp

Download

memory/4888-33-0x0000025061F30000-0x0000025061F50000-memory.dmp

Download

memory/4888-39-0x0000025061F70000-0x0000025061FA0000-memory.dmp

Download

memory/4888-29-0x0000025061F10000-0x0000025061F30000-memory.dmp

Download

memory/4888-13-0x0000020FCCEA0000-0x0000020FCCEC0000-memory.dmp

Download

memory/4888-10-0x0000025064A60000-0x0000025065750000-memory.dmp

Download