fdc6b0ad88563671c9fa742f6859fb8955a66b87d18f42c51ae9edcd349a87e3

Analysis

max time kernel
145s
max time network
153s
platform
windows10-2004_x64
resource
win10v2004-20230915-en
resource tags

arch:x64arch:x86image:win10v2004-20230915-enlocale:en-usos:windows10-2004-x64system
submitted
12/10/2023, 10:11

Target

Setup.exe
Size

1.6MB
MD5

8f0717916432e1e4f3313c8ebde55210
SHA1

41456cd9c3b66cfb22f9bbeefb6750cce516bf3a
SHA256

8dc4d5deef19fb4da195c270819a6ee283b67408fc9ee187216a0ce80ee61bab
SHA512

d1c4696541ec1d8d44e820902828bfbbd16afbb9c4a251080fc62262fbf879b268ed0fff80ea84aacdc58f424c516a979bb8fa82f0dfe920d71cad92f17bcfee
SSDEEP

12288:N2EDigMo6E50Hmy00qEEmxnA7ECCXuiAK6xXHDJBIMQV2:bFaky0wEmxAQCCXuiA3XH8N2

Score

5^/10

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 312 set thread context of 3480	312	Setup.exe	87

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
312	Setup.exe
3480	cmd.exe

Suspicious behavior: MapViewOfSection 2 IoCs

pid	Process
312	Setup.exe
3480	cmd.exe

Suspicious use of WriteProcessMemory 9 IoCs

description	pid	Process	procid_target
PID 312 wrote to memory of 3480	312	Setup.exe	87
PID 312 wrote to memory of 3480	312	Setup.exe	87
PID 312 wrote to memory of 3480	312	Setup.exe	87
PID 312 wrote to memory of 3480	312	Setup.exe	87
PID 3480 wrote to memory of 4856	3480	cmd.exe	103
PID 3480 wrote to memory of 4856	3480	cmd.exe	103
PID 3480 wrote to memory of 4856	3480	cmd.exe	103
PID 3480 wrote to memory of 4856	3480	cmd.exe	103
PID 3480 wrote to memory of 4856	3480	cmd.exe	103

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

C:\Users\Admin\AppData\Local\Temp\3a81a7d6

Filesize
1008KB

MD5
80069a82d6545e6202c504ab002179bf

SHA1
c56f68179ae6d0abb6389ec157bc9c7dd1807947

SHA256
7288cd9212609a0f4fc4067eddf00592d3e109893ac483befdcc690d221d7c1f

SHA512
f7638c9c3cca68bbf3d3fd9652090e5bfa8b1d4cdc974e9a4dc81a7157790ab56e4b882c4cb5f3ce4671e2f13f2db29eae8c38c6f25d1925d066d51e0d5f7162

Download Submit
memory/312-0-0x00007FF8D9D70000-0x00007FF8DB3E7000-memory.dmp

Filesize
22.5MB

Download
memory/312-1-0x00007FF8D9D70000-0x00007FF8DB3E7000-memory.dmp

Filesize
22.5MB

Download
memory/312-2-0x00007FF8D9D70000-0x00007FF8DB3E7000-memory.dmp

Filesize
22.5MB

Download
memory/3480-5-0x00007FF8F93D0000-0x00007FF8F95C5000-memory.dmp

Filesize
2.0MB

Download
memory/3480-7-0x00000000740A0000-0x00000000752F4000-memory.dmp

Filesize
18.3MB

Download
memory/3480-8-0x00000000740A0000-0x00000000752F4000-memory.dmp

Filesize
18.3MB

Download
memory/3480-12-0x00000000740A0000-0x00000000752F4000-memory.dmp

Filesize
18.3MB

Download
memory/4856-13-0x0000000000D30000-0x0000000000DA8000-memory.dmp

Filesize
480KB

Download
memory/4856-15-0x00007FF8F93D0000-0x00007FF8F95C5000-memory.dmp

Filesize
2.0MB

Download
memory/4856-16-0x0000000000D30000-0x0000000000DA8000-memory.dmp

Filesize
480KB

Download