055016d29bcf464189425405847337918275ab535aa5470c5907225174ac4dde

Analysis

max time kernel
91s
max time network
155s
platform
windows10-2004_x64
resource
win10v2004-20230703-en
resource tags

arch:x64arch:x86image:win10v2004-20230703-enlocale:en-usos:windows10-2004-x64system
submitted
08/08/2023, 18:16

Target

055016d29bcf464189425405847337918275ab535aa5470c5907225174ac4dde.exe
Size

266KB
MD5

495466b0e6eb9ef51edcd4838c210cb1
SHA1

896865cb802ee6f25289331badde5e7ecd441c09
SHA256

055016d29bcf464189425405847337918275ab535aa5470c5907225174ac4dde
SHA512

ebb41b9102e56217ca9d1f9cf57709add62ee776b331095d0e78987fc61277fe3468a2c181bf8b74436df9fbf686efefaaa30919b7095d36a4931b973147490b
SSDEEP

6144:2XzKdNY49u8rVMJm4ckV4dPMvc+/cv1Zb01net:Na4AzJm4cxd2/6b01

Score

7^/10

upx

Executes dropped EXE 2 IoCs

pid	Process
4868	ITS SB App Switch.exe
3708	ITS SB App Switch.exe

UPX packed file 2 IoCs

Detects executables packed with UPX/modified UPX open source packer.

resource	yara_rule
behavioral1/memory/4156-133-0x0000000000820000-0x00000000008C0000-memory.dmp	upx
behavioral1/memory/4156-147-0x0000000000820000-0x00000000008C0000-memory.dmp	upx

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious behavior: EnumeratesProcesses 4 IoCs

Suspicious use of WriteProcessMemory 6 IoCs

description	pid	Process	procid_target
PID 4156 wrote to memory of 4868	4156	055016d29bcf464189425405847337918275ab535aa5470c5907225174ac4dde.exe	81
PID 4156 wrote to memory of 4868	4156	055016d29bcf464189425405847337918275ab535aa5470c5907225174ac4dde.exe	81
PID 4156 wrote to memory of 4868	4156	055016d29bcf464189425405847337918275ab535aa5470c5907225174ac4dde.exe	81
PID 4156 wrote to memory of 3708	4156	055016d29bcf464189425405847337918275ab535aa5470c5907225174ac4dde.exe	82
PID 4156 wrote to memory of 3708	4156	055016d29bcf464189425405847337918275ab535aa5470c5907225174ac4dde.exe	82
PID 4156 wrote to memory of 3708	4156	055016d29bcf464189425405847337918275ab535aa5470c5907225174ac4dde.exe	82

C:\Users\Admin\AppData\Local\Temp\055016d29bcf464189425405847337918275ab535aa5470c5907225174ac4dde.exe
"C:\Users\Admin\AppData\Local\Temp\055016d29bcf464189425405847337918275ab535aa5470c5907225174ac4dde.exe"
1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:4156
- C:\Users\Admin\AppData\Local\Temp\ITS\wincsecb\264\Production\ITS SB App Switch.exe
  "C:\Users\Admin\AppData\Local\Temp\ITS\wincsecb\264\Production\ITS SB App Switch.exe"
  2⤵
  - Executes dropped EXE
  PID:4868
- C:\Users\Admin\AppData\Local\Temp\ITS\wincsecb\264\Production\ITS SB App Switch.exe
  "C:\Users\Admin\AppData\Local\Temp\ITS\wincsecb\264\Production\ITS SB App Switch.exe"
  2⤵
  - Executes dropped EXE
  PID:3708

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

C:\Users\Admin\AppData\Local\Temp\ITS\wincsecb\264\Production\ITS SB App Switch.exe

Filesize
87KB

MD5
368332fca74f48697d842c5f4698ae1d

SHA1
0275153a1e62bd0eca0b02168895517ed66aac56

SHA256
3a4a5b128c3a042010824fd33b719466b0d9320aa051ca3d5f1690124766ad59

SHA512
fd9f1d1a4337e00fef5e9ea10a7fdf553e98df2cf2fdf818b68689a89de3c1d324de389e0c9ef863fef08a3dff8150db173b2203e9e92efaea67865e8d2805b5

Download Submit
C:\Users\Admin\AppData\Local\Temp\ITS\wincsecb\264\Production\ITS SB App Switch.exe

Filesize
87KB

MD5
368332fca74f48697d842c5f4698ae1d

SHA1
0275153a1e62bd0eca0b02168895517ed66aac56

SHA256
3a4a5b128c3a042010824fd33b719466b0d9320aa051ca3d5f1690124766ad59

SHA512
fd9f1d1a4337e00fef5e9ea10a7fdf553e98df2cf2fdf818b68689a89de3c1d324de389e0c9ef863fef08a3dff8150db173b2203e9e92efaea67865e8d2805b5

Download Submit
C:\Users\Admin\AppData\Local\Temp\ITS\wincsecb\264\Production\ITS SB App Switch.exe

Filesize
87KB

MD5
368332fca74f48697d842c5f4698ae1d

SHA1
0275153a1e62bd0eca0b02168895517ed66aac56

SHA256
3a4a5b128c3a042010824fd33b719466b0d9320aa051ca3d5f1690124766ad59

SHA512
fd9f1d1a4337e00fef5e9ea10a7fdf553e98df2cf2fdf818b68689a89de3c1d324de389e0c9ef863fef08a3dff8150db173b2203e9e92efaea67865e8d2805b5

Download Submit
memory/4156-133-0x0000000000820000-0x00000000008C0000-memory.dmp

Filesize
640KB

Download
memory/4156-147-0x0000000000820000-0x00000000008C0000-memory.dmp

Filesize
640KB

Download