0527dc9d19e95c25ca4feb22e562f5fda68a6732483c2be9f05af6f9ed005107 | Triage

Analysis

max time kernel
152s
max time network
154s
platform
windows10-2004_x64
resource
win10v2004-20230220-en
resource tags

arch:x64arch:x86image:win10v2004-20230220-enlocale:en-usos:windows10-2004-x64system
submitted
14-06-2023 09:54

Sharing

Report Analysis Logs

General

Target

PEMIS.exe
Size

28.9MB
MD5

34a7eab02be0835b27e4548ad2ce048c
SHA1

17a2337c233658d36387b9c50f43aa53feeb422e
SHA256

0527dc9d19e95c25ca4feb22e562f5fda68a6732483c2be9f05af6f9ed005107
SHA512

9844035a58bf8398555e556592dc7b49bc591516a91b8da00270d551e1463de2302020b3d6600bdf2c4455bb7fd2c04b15b3cf7addbd39b0174b8cff60fc3be0
SSDEEP

786432:21NY0wjo8H/1uWX5xFYnmE0UcXSlwmKEu:IIjoQ15fgliSlwmK

Score

3^/10

Malware Config

Signatures

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082
Suspicious use of SetWindowsHookEx 6 IoCs

Processes:

PEMIS.exe

pid process

3176 PEMIS.exe
3176 PEMIS.exe
3176 PEMIS.exe
3176 PEMIS.exe
3176 PEMIS.exe
3176 PEMIS.exe

C:\Users\Admin\AppData\Local\Temp\PEMIS.exe
"C:\Users\Admin\AppData\Local\Temp\PEMIS.exe"
1⤵
- Suspicious use of SetWindowsHookEx
PID:3176

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/3176-133-0x0000000009AF0000-0x0000000009AF1000-memory.dmp

Filesize
4KB

Download
memory/3176-134-0x0000000000400000-0x0000000001400000-memory.dmp

Filesize
16.0MB

Download
memory/3176-135-0x0000000009AF0000-0x0000000009AF1000-memory.dmp

Filesize
4KB

Download