397f432f458e3d00af3b52dfa45bddc927e6a0a99569b31b2c57b9355c448519

Analysis

max time kernel
138s
max time network
143s
platform
windows10-2004_x64
resource
win10v2004-20230703-en
resource tags

arch:x64arch:x86image:win10v2004-20230703-enlocale:en-usos:windows10-2004-x64system
submitted
03-08-2023 14:02

Target

397f432f458e3d00af3b52dfa45bddc927e6a0a99569b31b2c57b9355c448519.exe
Size

390KB
MD5

1644558f2b046a5082baff609c2991ab
SHA1

06c80df6ea267094df72de35f82c125309db5196
SHA256

397f432f458e3d00af3b52dfa45bddc927e6a0a99569b31b2c57b9355c448519
SHA512

09843f47e193c158a353491b5cd3462ebc6b2a5caf1c0fda4c20e27a9f5d9742a8978e8f6edf98983fa95a80e0111abab673160a323d5d9e12980e3271a2903d
SSDEEP

6144:UpAodTJCGkP1QfMu8owFSiP4FZMYSb8ohlKdNaiSpTyzAvH:2ZCGaIMueQG4FZPokcyza

Score

3^/10

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious behavior: EnumeratesProcesses 4 IoCs

pid	Process
1712	397f432f458e3d00af3b52dfa45bddc927e6a0a99569b31b2c57b9355c448519.exe
1712	397f432f458e3d00af3b52dfa45bddc927e6a0a99569b31b2c57b9355c448519.exe
3940	powershell.exe
3940	powershell.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	3940	powershell.exe

Suspicious use of WriteProcessMemory 2 IoCs

description	pid	Process	procid_target
PID 1712 wrote to memory of 3940	1712	397f432f458e3d00af3b52dfa45bddc927e6a0a99569b31b2c57b9355c448519.exe	82
PID 1712 wrote to memory of 3940	1712	397f432f458e3d00af3b52dfa45bddc927e6a0a99569b31b2c57b9355c448519.exe	82

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_gqucp1zb.2kf.ps1

Filesize
60B

MD5
d17fe0a3f47be24a6453e9ef58c94641

SHA1
6ab83620379fc69f80c0242105ddffd7d98d5d9d

SHA256
96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

SHA512
5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

Download Submit
memory/3940-142-0x0000017EB8D30000-0x0000017EB8D52000-memory.dmp

Filesize
136KB

Download
memory/3940-143-0x00007FF8254F0000-0x00007FF825FB1000-memory.dmp

Filesize
10.8MB

Download
memory/3940-144-0x0000017EA02C0000-0x0000017EA02D0000-memory.dmp

Filesize
64KB

Download
memory/3940-145-0x0000017EA02C0000-0x0000017EA02D0000-memory.dmp

Filesize
64KB

Download
memory/3940-146-0x00007FF8254F0000-0x00007FF825FB1000-memory.dmp

Filesize
10.8MB

Download
memory/3940-147-0x0000017EA02C0000-0x0000017EA02D0000-memory.dmp

Filesize
64KB

Download
memory/3940-148-0x0000017EA02C0000-0x0000017EA02D0000-memory.dmp

Filesize
64KB

Download
memory/3940-149-0x0000017EA02C0000-0x0000017EA02D0000-memory.dmp

Filesize
64KB

Download
memory/3940-152-0x00007FF8254F0000-0x00007FF825FB1000-memory.dmp

Filesize
10.8MB

Download