36a28f5eebc2c87b065ba1ff1ded73b25a4f8e0f55aaff21179baac6cd15c4d8

Analysis

max time kernel
30s
max time network
33s
platform
windows7_x64
resource
win7-20230220-en
resource tags

arch:x64arch:x86image:win7-20230220-enlocale:en-usos:windows7-x64system
submitted
18-05-2023 11:37

Target

LICK_Credit_Return.exe
Size

2.4MB
MD5

3f810c13d21fa903e0e9c9daf93f7a8b
SHA1

17a27b25bbe260ee45b50a181d2c04030238a1a9
SHA256

f9d30714fb0e87894da5d0a690375eb17b66652b0aacd24ba336bb166f9e5efe
SHA512

a031e87037ff964c6612f24eb785515926ddd8b23fa58e313df4ae94a023a60849d92d2f97976c2bc0542f52f15e9eb63fefdddc0d90aa487be36667b45a6e3a
SSDEEP

49152:PHkWk5cS7a+9XYaQ1Zehc4mTYJ78V9gyBn4cH4cefmP/SA8N:P/ajJ+Z942KQV9hp4IefmP/SA8

Score

3^/10

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082
Suspicious use of SetWindowsHookEx 3 IoCs

Processes:

LICK_Credit_Return.exe

pid process

1292 LICK_Credit_Return.exe
1292 LICK_Credit_Return.exe
1292 LICK_Credit_Return.exe

Suspicious use of WriteProcessMemory 4 IoCs

Processes:

LICK_Credit_Return.exe

description	pid	process	target process
PID 1292 wrote to memory of 932	1292	LICK_Credit_Return.exe	cmd.exe
PID 1292 wrote to memory of 932	1292	LICK_Credit_Return.exe	cmd.exe
PID 1292 wrote to memory of 932	1292	LICK_Credit_Return.exe	cmd.exe
PID 1292 wrote to memory of 932	1292	LICK_Credit_Return.exe	cmd.exe

C:\Users\Admin\AppData\Local\Temp\LICK_Credit_Return.exe
"C:\Users\Admin\AppData\Local\Temp\LICK_Credit_Return.exe"
1⤵
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1292
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c C:\Users\Admin\AppData\Local\Temp\
  2⤵
  PID:932

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact