b96bfa86cbda44acf53a70c702327b2f5d5cef3023b0635f00b50f4a677f1426

Analysis

max time kernel
85s
max time network
30s
platform
windows7_x64
resource
win7-20230220-es
resource tags

arch:x64arch:x86image:win7-20230220-eslocale:es-esos:windows7-x64systemwindows
submitted
24-04-2023 05:20

Target

nipe/.git/hooks/update.sample
Size

3KB
MD5

647ae13c682f7827c22f5fc08a03674e
SHA1

730e6bd5225478bab6147b7a62a6e2ae21d40507
SHA256

8d5f2fa83e103cf08b57eaa67521df9194f45cbdbcb37da52ad586097a14d106
SHA512

be3780974589d06eddba6fa0aa15a3e3dfe390e2827a1a6ae5cb83d6ac47e79ef9b1bbb53f067372f8dc70db0350d3770e78537fd3cfe734200ff824eca4cada

Score

3^/10

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082
Modifies registry class 1 IoCs

Processes:

rundll32.exe

description ioc process

Key created \REGISTRY\USER\S-1-5-21-3499517378-2376672570-1134980332-1000_Classes\Local Settings rundll32.exe
Suspicious behavior: GetForegroundWindowSpam 1 IoCs

Processes:

rundll32.exe

pid process

1700 rundll32.exe

description	ioc	process
Key created	\REGISTRY\USER\S-1-5-21-3499517378-2376672570-1134980332-1000_Classes\Local Settings	rundll32.exe

pid	process
1700	rundll32.exe

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

cmd.exe

description	pid	process	target process
PID 2000 wrote to memory of 1700	2000	cmd.exe	rundll32.exe
PID 2000 wrote to memory of 1700	2000	cmd.exe	rundll32.exe
PID 2000 wrote to memory of 1700	2000	cmd.exe	rundll32.exe

C:\Windows\system32\cmd.exe
cmd /c C:\Users\Admin\AppData\Local\Temp\nipe\.git\hooks\update.sample
1⤵
- Suspicious use of WriteProcessMemory
PID:2000

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact