eadaf26df948f0fd541f297e2f0bad435aa4bee5c97e4324ad767dacca77e29d

max time kernel
81s
max time network
480s
platform
windows10-2004_x64
resource
win10v2004-20230220-en
resource tags

arch:x64arch:x86image:win10v2004-20230220-enlocale:en-usos:windows10-2004-x64system
submitted
09-05-2023 19:14

Sharing

Target

trojan-leaks-main/skidded/Unis.exe
Size

892KB
MD5

e72088233e9d7d1d9826a35604c49fd7
SHA1

fa8a5990e2e1b7fb8e23af3ae54be58fce2125c2
SHA256

d2e3b68594ba8a21eb03056554dcc6ed43030e6e2969caef6f205fe86390339c
SHA512

3fdf6da405782b8ab3105ae088b85f0616df27fb58042bc9e4adc458017e345e8bb4199ccc1b4682f8471bc463c888ff658513bb25ed0f1cc6027c0606cf69b5
SSDEEP

12288:GoSWNTlKOtLP3gagtWFvD34Isq0hZsEZy35LDSbtn6tfJtvDyG4G99:GoS2TlhtKidsd+EZV6NJdUA9

Score

3^/10

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082
Suspicious use of WriteProcessMemory 2 IoCs

Processes:

Unis.exe

description pid process target process

PID 4376 wrote to memory of 2900 4376 Unis.exe cmd.exe
PID 4376 wrote to memory of 2900 4376 Unis.exe cmd.exe

description	pid	process	target process
PID 4376 wrote to memory of 2900	4376	Unis.exe	cmd.exe
PID 4376 wrote to memory of 2900	4376	Unis.exe	cmd.exe

C:\Users\Admin\AppData\Local\Temp\trojan-leaks-main\skidded\Unis.exe
"C:\Users\Admin\AppData\Local\Temp\trojan-leaks-main\skidded\Unis.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:4376
- C:\Windows\system32\cmd.exe
  "C:\Windows\sysnative\cmd" /c "C:\Users\Admin\AppData\Local\Temp\ED0C.tmp\ED0D.tmp\ED0E.bat C:\Users\Admin\AppData\Local\Temp\trojan-leaks-main\skidded\Unis.exe"
  2⤵
  PID:2900

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

C:\Users\Admin\AppData\Local\Temp\ED0C.tmp\ED0D.tmp\ED0E.bat

Filesize
714B

MD5
c645904efc201e9cc2660d251a08f3cb

SHA1
6d35f7f5f7012710b228a280e2a49eff98e4adcd

SHA256
4e254ec30432a08d7a2a11ed188bd017fd555bd998c7233c1f444541fac5001b

SHA512
053f781df0403561cf5889aa7d0688f5ab13a2005524aa4ac2be911c0a7597544763c726d9e40e894773bcc73e37f11113576fa2567d05e83ff64790e423ef73

Download Submit