3a72828a2905a6a4983a356a4bd5ef03bc309aa05a7eee476fc68e4f557b6cc5

Analysis

max time kernel
143s
max time network
163s
platform
windows10-2004_x64
resource
win10v2004-20230915-en
resource tags

arch:x64arch:x86image:win10v2004-20230915-enlocale:en-usos:windows10-2004-x64system
submitted
12/10/2023, 07:28

Target
Payment_200923.exe
Size 1.0MB
Sample231012-ja3fhagb23
SHA256 3a72828a2905a6a4983a356a4bd5ef03bc309aa05a7eee476fc68e4f557b6cc5
MD5 773fc13b84c7e67b3a013cd55e54c89b
SHA1 6347364c3af797881505ca43969677c2e1fedaac
SHA512 efed8123d447ae677814157f1e40a0e72a0033d33991970cdcd427d70bcf04cc10820b47df9926d3a4137cecce7ac4c87c43e21f2b0dce14a4c8f479a8cf7f29
SSDEEP 12288:0tPtevQRR4XG18bapQ2jMRKHAl+biBkLWV4/K5fkNaDghm3sYHm9UTC5wv1yvMpm:0WfmP/UDMS08Ckn3
MD5 SHA1 SHA512 SSDEEP

Score

3^/10

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious use of SetWindowsHookEx 3 IoCs

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 1076 wrote to memory of 1412	1076	Payment_200923.exe	90
PID 1076 wrote to memory of 1412	1076	Payment_200923.exe	90
PID 1076 wrote to memory of 1412	1076	Payment_200923.exe	90

C:\Users\Admin\AppData\Local\Temp\Payment_200923.exe
"C:\Users\Admin\AppData\Local\Temp\Payment_200923.exe"
1⤵
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1076
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c C:\Users\Admin\AppData\Local\Temp\
  2⤵
  PID:1412

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact