6c2382a2355ef4a1eb1c0f5c540bdb0003360f508ca5b54a2122decb09004c34

Analysis

max time kernel
84s
max time network
134s
platform
windows10-2004_x64
resource
win10v2004-20230703-en
resource tags

arch:x64arch:x86image:win10v2004-20230703-enlocale:en-usos:windows10-2004-x64system
submitted
27/08/2023, 10:43

Target

6c2382a2355ef4a1eb1c0f5c540bdb0003360f508ca5b54a2122decb09004c34.exe
Size

1.2MB
MD5

1b91b68145dbd84d9ded1fb64e175339
SHA1

7a2982d3637198bd7d9f12bfc33be379478b6ed1
SHA256

6c2382a2355ef4a1eb1c0f5c540bdb0003360f508ca5b54a2122decb09004c34
SHA512

0d0c51fe203441af404860f3c54ff086bbebee50216c7aff68dad8778df2db73d616b9380a71a4b5349ebf93aa9b57cb64f31cbdf491bdedfbcb37e6f061af5a
SSDEEP

24576:7EvVxo2ivb4YLWFTggTPoICcQw0Eq6ZlrTtGNP+0TkFP4S86RDFMm:7Efozb4YLWFTgHICcQwPZFtGNP+0TYPv

Score

3^/10

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious behavior: EnumeratesProcesses 14 IoCs

pid	Process
3296	6c2382a2355ef4a1eb1c0f5c540bdb0003360f508ca5b54a2122decb09004c34.exe
3296	6c2382a2355ef4a1eb1c0f5c540bdb0003360f508ca5b54a2122decb09004c34.exe
3296	6c2382a2355ef4a1eb1c0f5c540bdb0003360f508ca5b54a2122decb09004c34.exe
3296	6c2382a2355ef4a1eb1c0f5c540bdb0003360f508ca5b54a2122decb09004c34.exe
3296	6c2382a2355ef4a1eb1c0f5c540bdb0003360f508ca5b54a2122decb09004c34.exe
3296	6c2382a2355ef4a1eb1c0f5c540bdb0003360f508ca5b54a2122decb09004c34.exe
3296	6c2382a2355ef4a1eb1c0f5c540bdb0003360f508ca5b54a2122decb09004c34.exe
3296	6c2382a2355ef4a1eb1c0f5c540bdb0003360f508ca5b54a2122decb09004c34.exe
3296	6c2382a2355ef4a1eb1c0f5c540bdb0003360f508ca5b54a2122decb09004c34.exe
3296	6c2382a2355ef4a1eb1c0f5c540bdb0003360f508ca5b54a2122decb09004c34.exe
3296	6c2382a2355ef4a1eb1c0f5c540bdb0003360f508ca5b54a2122decb09004c34.exe
3296	6c2382a2355ef4a1eb1c0f5c540bdb0003360f508ca5b54a2122decb09004c34.exe
3296	6c2382a2355ef4a1eb1c0f5c540bdb0003360f508ca5b54a2122decb09004c34.exe
3296	6c2382a2355ef4a1eb1c0f5c540bdb0003360f508ca5b54a2122decb09004c34.exe

C:\Users\Admin\AppData\Local\Temp\6c2382a2355ef4a1eb1c0f5c540bdb0003360f508ca5b54a2122decb09004c34.exe
"C:\Users\Admin\AppData\Local\Temp\6c2382a2355ef4a1eb1c0f5c540bdb0003360f508ca5b54a2122decb09004c34.exe"
1⤵
- Suspicious behavior: EnumeratesProcesses
PID:3296

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

C:\Users\Admin\AppData\Roaming\Helper_2345\temp\download\0\Helper_2345.NewVersion.data

Filesize
29B

MD5
99fb8e84b8aa92889349054a60e1f359

SHA1
1b3dd1afb4fe4533ca16db4dd3e7845c13b0e1c5

SHA256
5313e624a817ebcb34675027d12b87465de4fc4fdddfdd74d244490c4911b8e4

SHA512
2a99095109445c3ca1b9fad5c87fdfed331641401ca8d19d3ab4d109e18b9dc5feb739485f14f390bd3bcfa3a4325e3b1278fe1bb8690dd8df16edb9af52faac

Download Submit
memory/3296-0-0x0000000000400000-0x0000000000529000-memory.dmp

Filesize
1.2MB

Download
memory/3296-30-0x0000000000400000-0x0000000000529000-memory.dmp

Filesize
1.2MB

Download