7f937955f17bd5a00f7eb89f2d6613f93cd28773fd17c57bb73f380e8077414d

Analysis

max time kernel
20s
max time network
24s
platform
windows7_x64
resource
win7-20230831-en
resource tags

arch:x64arch:x86image:win7-20230831-enlocale:en-usos:windows7-x64system
submitted
21/09/2023, 16:42

Target

Element Installer.exe
Size

294.8MB
MD5

411446b3177a243a1e5587e06bcbbe57
SHA1

0b03a7f9057cd03a48dc05a165ba3c29cd6dd5aa
SHA256

7f937955f17bd5a00f7eb89f2d6613f93cd28773fd17c57bb73f380e8077414d
SHA512

c68cd3672c44326e70877dd0b04bf3c54ed95416b11b66e43877aba39895c4689ce3a98e7b80b3be8fcaefff5a25f41ec9cadb6d613d1c454c93af59350e44ed
SSDEEP

6291456:/uTHeNh2KPcm20VCbCssKaYn+mGoMaZDVoxM6Xwurp14n5Csrtx5ZYm:qHeNUYVwNsKaYnqoLDVoxSUpK51zz

Score

3^/10

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 3028 wrote to memory of 1728	3028	Element Installer.exe	28
PID 3028 wrote to memory of 1728	3028	Element Installer.exe	28
PID 3028 wrote to memory of 1728	3028	Element Installer.exe	28
PID 3028 wrote to memory of 1728	3028	Element Installer.exe	28
PID 3028 wrote to memory of 1728	3028	Element Installer.exe	28
PID 3028 wrote to memory of 1728	3028	Element Installer.exe	28
PID 3028 wrote to memory of 1728	3028	Element Installer.exe	28

C:\Users\Admin\AppData\Local\Temp\Element Installer.exe
"C:\Users\Admin\AppData\Local\Temp\Element Installer.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:3028
- C:\Users\Admin\AppData\Local\Temp\Element Installer.exe
  "C:\Users\Admin\AppData\Local\Temp\Element Installer.exe" /UAC
  2⤵
  PID:1728

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact