bbd173c3dc46144dc1484dd01aa8d2f9d61ca2e95efc389578cb1338b5147b95 | Triage

Analysis

max time kernel
146s
max time network
153s
platform
windows10-2004_x64
resource
win10v2004-20230221-en
resource tags

arch:x64arch:x86image:win10v2004-20230221-enlocale:en-usos:windows10-2004-x64system
submitted
14-06-2023 17:44

Sharing

Report Analysis Logs

General

Target

PEMIS.exe
Size

28.6MB
MD5

4050aac68b152086bb1e15bf36060206
SHA1

757ce20862010bc42265deefeed03f61bd9d198f
SHA256

bbd173c3dc46144dc1484dd01aa8d2f9d61ca2e95efc389578cb1338b5147b95
SHA512

c163d4f28abed33c544e3f6e4878580bc301370f78cb140c7ef1d0cbfa0cd14225249a6e9b7ce65c3ebb666a58cede99d37c60fcc554dc96b115d1a942785f4e
SSDEEP

786432:1PnUYm2+bfNjDMKITP8y2Q9DZmE0UcXSlw2wYjS7e:FnUYmHfNnMKK8ofliSlw2bp

Score

3^/10

Malware Config

Signatures

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082
Suspicious use of SetWindowsHookEx 6 IoCs

Processes:

PEMIS.exe

pid process

2740 PEMIS.exe
2740 PEMIS.exe
2740 PEMIS.exe
2740 PEMIS.exe
2740 PEMIS.exe
2740 PEMIS.exe

C:\Users\Admin\AppData\Local\Temp\PEMIS.exe
"C:\Users\Admin\AppData\Local\Temp\PEMIS.exe"
1⤵
- Suspicious use of SetWindowsHookEx
PID:2740

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2740-133-0x0000000009690000-0x0000000009691000-memory.dmp

Filesize
4KB

Download
memory/2740-134-0x0000000000400000-0x0000000001400000-memory.dmp

Filesize
16.0MB

Download
memory/2740-135-0x0000000009690000-0x0000000009691000-memory.dmp

Filesize
4KB

Download