81561f8e9a046561703b3bd09e1af1b474d1202208bf0b4ba638d740a9ed8d2d

Analysis

max time kernel
150s
max time network
152s
platform
windows7_x64
resource
win7-20230712-en
resource tags

arch:x64arch:x86image:win7-20230712-enlocale:en-usos:windows7-x64system
submitted
29/08/2023, 18:09

Target

81561f8e9a046561703b3bd09e1af1b474d1202208bf0b4ba638d740a9ed8d2d.exe
Size

1.1MB
MD5

522a2716cf311d615039b17deff1630c
SHA1

cb8ece346bfad9a7c9a3f75c7e4882a20fbf0353
SHA256

81561f8e9a046561703b3bd09e1af1b474d1202208bf0b4ba638d740a9ed8d2d
SHA512

e188e52e3a44e46be784e77c6bb344af0afb6f6292de511ca0d30607728d6a06bdfa68cb599f161a5bd097c2760bb3ee39c6146600885240e850dfb499f531b7
SSDEEP

24576:IRW3N/0f/oAPoRBchI5anfOlAUAi1K6oElG4lBujFAiCyRS:I5ApamAUAQ/lG4lBmFAiZS

Score

3^/10

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious behavior: EnumeratesProcesses 9 IoCs

pid	Process
1980	81561f8e9a046561703b3bd09e1af1b474d1202208bf0b4ba638d740a9ed8d2d.exe
1980	81561f8e9a046561703b3bd09e1af1b474d1202208bf0b4ba638d740a9ed8d2d.exe
1980	81561f8e9a046561703b3bd09e1af1b474d1202208bf0b4ba638d740a9ed8d2d.exe
1980	81561f8e9a046561703b3bd09e1af1b474d1202208bf0b4ba638d740a9ed8d2d.exe
1980	81561f8e9a046561703b3bd09e1af1b474d1202208bf0b4ba638d740a9ed8d2d.exe
1980	81561f8e9a046561703b3bd09e1af1b474d1202208bf0b4ba638d740a9ed8d2d.exe
1980	81561f8e9a046561703b3bd09e1af1b474d1202208bf0b4ba638d740a9ed8d2d.exe
1980	81561f8e9a046561703b3bd09e1af1b474d1202208bf0b4ba638d740a9ed8d2d.exe
1980	81561f8e9a046561703b3bd09e1af1b474d1202208bf0b4ba638d740a9ed8d2d.exe

Suspicious behavior: RenamesItself 1 IoCs

pid	Process
1980	81561f8e9a046561703b3bd09e1af1b474d1202208bf0b4ba638d740a9ed8d2d.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
1980	81561f8e9a046561703b3bd09e1af1b474d1202208bf0b4ba638d740a9ed8d2d.exe
1980	81561f8e9a046561703b3bd09e1af1b474d1202208bf0b4ba638d740a9ed8d2d.exe

Suspicious use of WriteProcessMemory 8 IoCs

description	pid	Process	procid_target
PID 1980 wrote to memory of 2044	1980	81561f8e9a046561703b3bd09e1af1b474d1202208bf0b4ba638d740a9ed8d2d.exe	28
PID 1980 wrote to memory of 2044	1980	81561f8e9a046561703b3bd09e1af1b474d1202208bf0b4ba638d740a9ed8d2d.exe	28
PID 1980 wrote to memory of 2044	1980	81561f8e9a046561703b3bd09e1af1b474d1202208bf0b4ba638d740a9ed8d2d.exe	28
PID 1980 wrote to memory of 2044	1980	81561f8e9a046561703b3bd09e1af1b474d1202208bf0b4ba638d740a9ed8d2d.exe	28
PID 1980 wrote to memory of 2040	1980	81561f8e9a046561703b3bd09e1af1b474d1202208bf0b4ba638d740a9ed8d2d.exe	29
PID 1980 wrote to memory of 2040	1980	81561f8e9a046561703b3bd09e1af1b474d1202208bf0b4ba638d740a9ed8d2d.exe	29
PID 1980 wrote to memory of 2040	1980	81561f8e9a046561703b3bd09e1af1b474d1202208bf0b4ba638d740a9ed8d2d.exe	29
PID 1980 wrote to memory of 2040	1980	81561f8e9a046561703b3bd09e1af1b474d1202208bf0b4ba638d740a9ed8d2d.exe	29

C:\Users\Admin\AppData\Local\Temp\81561f8e9a046561703b3bd09e1af1b474d1202208bf0b4ba638d740a9ed8d2d.exe
"C:\Users\Admin\AppData\Local\Temp\81561f8e9a046561703b3bd09e1af1b474d1202208bf0b4ba638d740a9ed8d2d.exe"
1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: RenamesItself
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1980
- C:\Windows\SysWOW64\WScript.exe
  "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Roaming\Microsoft\VBS3.vbs"
  2⤵
  PID:2044
- C:\Windows\SysWOW64\WScript.exe
  "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Roaming\Microsoft\VBS3.vbs"
  2⤵
  PID:2040

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

C:\Users\Admin\AppData\Roaming\Microsoft\Config.ini

Filesize
92B

MD5
3af60b9721ab2950705b75fe4c2e2059

SHA1
9766ee43f32bde57ca08301fb1b318acf7b875fb

SHA256
1c295097974803940bae6aedbba7acb041dfd9509c1ce5c105070ba2ad64e7ee

SHA512
f9914754e2da99ce01120d3f46767a65c9e4e693c0d015c87b3ce10369a2fc7067e4cc4ac165c073d0ae0d9c010b620d8317790e139b345f03c71cf7c67751d2

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\VBS3.vbs

Filesize
753B

MD5
a5250940888f7db254bf4f0568971788

SHA1
5e1fd04ea604eab244cc8f85b52db1bef388a16c

SHA256
3a570a1c1d38df69ffd2bc6acd1603227de6e8e829526859170fac24ec794053

SHA512
5bd4ab8246bc1a340e78c0d17eb83ea9a0d9e81b89342ea23eefe9dbd87acfceecb0a6d40e99670b0dcec2c5b3f4380c4e7f0bd55f3397406a737699029b172b

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\VBS3.vbs

Filesize
753B

MD5
a5250940888f7db254bf4f0568971788

SHA1
5e1fd04ea604eab244cc8f85b52db1bef388a16c

SHA256
3a570a1c1d38df69ffd2bc6acd1603227de6e8e829526859170fac24ec794053

SHA512
5bd4ab8246bc1a340e78c0d17eb83ea9a0d9e81b89342ea23eefe9dbd87acfceecb0a6d40e99670b0dcec2c5b3f4380c4e7f0bd55f3397406a737699029b172b

Download Submit