1d54a021297a3d55fb716e03fb9713981c9ccd60a596a4e110f7d141e0d79924

Analysis

max time kernel
127s
max time network
133s
platform
windows10-2004_x64
resource
win10v2004-20230915-en
resource tags

arch:x64arch:x86image:win10v2004-20230915-enlocale:en-usos:windows10-2004-x64system
submitted
10-10-2023 06:29

Target

1d54a021297a3d55fb716e03fb9713981c9ccd60a596a4e110f7d141e0d79924.exe
Size

179KB
MD5

52f7b686d57e29f04f761290a1a5ea0b
SHA1

2f9eee26af9607262dd3b54490860c9154e62144
SHA256

1d54a021297a3d55fb716e03fb9713981c9ccd60a596a4e110f7d141e0d79924
SHA512

e2b84b95ffa75ae377ed2f6e1a95e71624ea2bfc4d52f862b222ea78dc74d72cc32be7248f5bdd9f1938d90b03eef78392851fe2f85adf4fafc20532e06b8c3d
SSDEEP

3072:hstajHKBvYXJLC0ZgxVEiaCi6p5nA5ci+g3Q3gk1HjGIG:hTq+MnaCiyJAig3Q3t1c

Score

4^/10

Drops file in Program Files directory 2 IoCs

description	ioc	Process
File created	C:\Program Files (x86)\Sangfor\SSL\SangforUpdate\SangforUD.exe	1d54a021297a3d55fb716e03fb9713981c9ccd60a596a4e110f7d141e0d79924.exe
File created	C:\Program Files (x86)\Sangfor\SSL\SangforUpdate\Uninstaller.exe	1d54a021297a3d55fb716e03fb9713981c9ccd60a596a4e110f7d141e0d79924.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

C:\Users\Admin\AppData\Local\Temp\1d54a021297a3d55fb716e03fb9713981c9ccd60a596a4e110f7d141e0d79924.exe
"C:\Users\Admin\AppData\Local\Temp\1d54a021297a3d55fb716e03fb9713981c9ccd60a596a4e110f7d141e0d79924.exe"
1⤵
- Drops file in Program Files directory
PID:2724

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact