3a72828a2905a6a4983a356a4bd5ef03bc309aa05a7eee476fc68e4f557b6cc5

Analysis

max time kernel
143s
max time network
153s
platform
windows10-2004_x64
resource
win10v2004-20230915-en
resource tags

arch:x64arch:x86image:win10v2004-20230915-enlocale:en-usos:windows10-2004-x64system
submitted
21-09-2023 13:10

Target

Payment_200923.exe
Size

1.0MB
MD5

773fc13b84c7e67b3a013cd55e54c89b
SHA1

6347364c3af797881505ca43969677c2e1fedaac
SHA256

3a72828a2905a6a4983a356a4bd5ef03bc309aa05a7eee476fc68e4f557b6cc5
SHA512

efed8123d447ae677814157f1e40a0e72a0033d33991970cdcd427d70bcf04cc10820b47df9926d3a4137cecce7ac4c87c43e21f2b0dce14a4c8f479a8cf7f29
SSDEEP

12288:0tPtevQRR4XG18bapQ2jMRKHAl+biBkLWV4/K5fkNaDghm3sYHm9UTC5wv1yvMpm:0WfmP/UDMS08Ckn3

Score

3^/10

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082
Suspicious use of SetWindowsHookEx 3 IoCs

Processes:

Payment_200923.exe

pid process

4620 Payment_200923.exe
4620 Payment_200923.exe
4620 Payment_200923.exe

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

Payment_200923.exe

description	pid	process	target process
PID 4620 wrote to memory of 4664	4620	Payment_200923.exe	cmd.exe
PID 4620 wrote to memory of 4664	4620	Payment_200923.exe	cmd.exe
PID 4620 wrote to memory of 4664	4620	Payment_200923.exe	cmd.exe

C:\Users\Admin\AppData\Local\Temp\Payment_200923.exe
"C:\Users\Admin\AppData\Local\Temp\Payment_200923.exe"
1⤵
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4620
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c C:\Users\Admin\AppData\Local\Temp\
  2⤵
  PID:4664

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact