318526b108539af55ec23b5a9720441d39e944e222e5322455a9845d99d4ad04

Analysis

max time kernel
30s
max time network
32s
platform
windows7_x64
resource
win7-20230621-en
resource tags

arch:x64arch:x86image:win7-20230621-enlocale:en-usos:windows7-x64system
submitted
25-06-2023 18:21

Target

windows.sig
Size

4.5MB
MD5

96750118e244a2afe885ad737b3dfd84
SHA1

8e86e84c5672d5d365b8553ba9cedc927b0df1b9
SHA256

318526b108539af55ec23b5a9720441d39e944e222e5322455a9845d99d4ad04
SHA512

0d0fb426074f0c6e1bbaa5579d16b62ba51096d56a83c652fddb72da472d5a9355f75d66645b648b4b9d8dedaaf2514d13a07cc2c91e81e40e1846fb7d719ecc
SSDEEP

24576:DTYQHui+zuYJod2mSBhkVa+Q3KhKa3KBpPk:vYXiSB5ZGePk

Score

3^/10

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-1306246566-3334493410-3785284834-1000_Classes\Local Settings	rundll32.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
980	rundll32.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 1532 wrote to memory of 980	1532	cmd.exe	29
PID 1532 wrote to memory of 980	1532	cmd.exe	29
PID 1532 wrote to memory of 980	1532	cmd.exe	29

C:\Windows\system32\cmd.exe
cmd /c C:\Users\Admin\AppData\Local\Temp\windows.sig
1⤵
- Suspicious use of WriteProcessMemory
PID:1532
- C:\Windows\system32\rundll32.exe
  "C:\Windows\system32\rundll32.exe" C:\Windows\system32\shell32.dll,OpenAs_RunDLL C:\Users\Admin\AppData\Local\Temp\windows.sig
  2⤵
  - Modifies registry class
  - Suspicious behavior: GetForegroundWindowSpam
  PID:980

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact