0d131d8ad3c79f22c03970df7345832eb4de17545be1f078c3063e66de6ac4b5

Analysis

max time kernel
28s
max time network
32s
platform
windows7_x64
resource
win7-20230220-en
resource tags

arch:x64arch:x86image:win7-20230220-enlocale:en-usos:windows7-x64system
submitted
24-05-2023 06:42

Target

CLAIM FORM - PART A.bat.exe
Size

2.6MB
MD5

7d5f71b752b46ee22a1072c5467e1767
SHA1

e79994a5a067f8ef997318a8829566f31305d202
SHA256

0d131d8ad3c79f22c03970df7345832eb4de17545be1f078c3063e66de6ac4b5
SHA512

9fb5640ae73335361ca6b166e7308036c0b6c2c892def329a7957bfb190dab1ccacf5e6a50ebc17a6c00de7d69d3646e1144fd4fe177ac8b2a1f30aff4ef1c11
SSDEEP

49152:FgvkWk5cS7a+9XYaQpZehc4mTYJ78V9gyBn4cmfmP/SA8N:iajJiZ942KQV9hp4DfmP/SA8

Score

3^/10

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082
Suspicious use of SetWindowsHookEx 3 IoCs

Processes:

CLAIM FORM - PART A.bat.exe

pid process

1536 CLAIM FORM - PART A.bat.exe
1536 CLAIM FORM - PART A.bat.exe
1536 CLAIM FORM - PART A.bat.exe

Suspicious use of WriteProcessMemory 4 IoCs

Processes:

CLAIM FORM - PART A.bat.exe

description	pid	process	target process
PID 1536 wrote to memory of 924	1536	CLAIM FORM - PART A.bat.exe	cmd.exe
PID 1536 wrote to memory of 924	1536	CLAIM FORM - PART A.bat.exe	cmd.exe
PID 1536 wrote to memory of 924	1536	CLAIM FORM - PART A.bat.exe	cmd.exe
PID 1536 wrote to memory of 924	1536	CLAIM FORM - PART A.bat.exe	cmd.exe

C:\Users\Admin\AppData\Local\Temp\CLAIM FORM - PART A.bat.exe
"C:\Users\Admin\AppData\Local\Temp\CLAIM FORM - PART A.bat.exe"
1⤵
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1536
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c C:\Users\Admin\AppData\Local\Temp\
  2⤵
  PID:924

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact