07eb2f54ad6910071c17ec899bb151f7e174cfaf94f54f5d8f8d08131bfe75d9

Analysis

max time kernel
118s
max time network
123s
platform
windows7_x64
resource
win7-20230831-en
resource tags

arch:x64arch:x86image:win7-20230831-enlocale:en-usos:windows7-x64system
submitted
14/10/2023, 02:45

Target

07eb2f54ad6910071c17ec899bb151f7e174cfaf94f54f5d8f8d08131bfe75d9.exe
Size

8.7MB
MD5

d2f0b31814de49e311ce5dbc6b99d096
SHA1

9cc372b964ffd717d9d206c78700bbc084e9a254
SHA256

07eb2f54ad6910071c17ec899bb151f7e174cfaf94f54f5d8f8d08131bfe75d9
SHA512

92e73bb62309988fd5b792ff267b37e6aa5bdb7443d7909f04011d6dc16437bcb453678de965e25f2c0c5541108411deb936055b8350fa285a38b2eebebb3125
SSDEEP

196608:kgwX9zd+In2r3IcI9MtgrrH8zWil3QipP:k7eInPwK8zBBR

Score

7^/10

Executes dropped EXE 1 IoCs

pid	Process
3048	HardWare_QC_UFS_TOOLS.exe

Loads dropped DLL 1 IoCs

pid	Process
2468	07eb2f54ad6910071c17ec899bb151f7e174cfaf94f54f5d8f8d08131bfe75d9.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
2468	07eb2f54ad6910071c17ec899bb151f7e174cfaf94f54f5d8f8d08131bfe75d9.exe
2468	07eb2f54ad6910071c17ec899bb151f7e174cfaf94f54f5d8f8d08131bfe75d9.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
2468	07eb2f54ad6910071c17ec899bb151f7e174cfaf94f54f5d8f8d08131bfe75d9.exe
2468	07eb2f54ad6910071c17ec899bb151f7e174cfaf94f54f5d8f8d08131bfe75d9.exe

Suspicious use of WriteProcessMemory 5 IoCs

description	pid	Process	procid_target
PID 2468 wrote to memory of 3048	2468	07eb2f54ad6910071c17ec899bb151f7e174cfaf94f54f5d8f8d08131bfe75d9.exe	28
PID 2468 wrote to memory of 3048	2468	07eb2f54ad6910071c17ec899bb151f7e174cfaf94f54f5d8f8d08131bfe75d9.exe	28
PID 2468 wrote to memory of 3048	2468	07eb2f54ad6910071c17ec899bb151f7e174cfaf94f54f5d8f8d08131bfe75d9.exe	28
PID 2468 wrote to memory of 3048	2468	07eb2f54ad6910071c17ec899bb151f7e174cfaf94f54f5d8f8d08131bfe75d9.exe	28
PID 2468 wrote to memory of 3048	2468	07eb2f54ad6910071c17ec899bb151f7e174cfaf94f54f5d8f8d08131bfe75d9.exe	28

C:\Users\Admin\AppData\Local\Temp\07eb2f54ad6910071c17ec899bb151f7e174cfaf94f54f5d8f8d08131bfe75d9.exe
"C:\Users\Admin\AppData\Local\Temp\07eb2f54ad6910071c17ec899bb151f7e174cfaf94f54f5d8f8d08131bfe75d9.exe"
1⤵
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2468
- C:\Users\Admin\AppData\Local\Temp\HardWare_QC_UFS_TOOLS.exe
  "C:\Users\Admin\AppData\Local\Temp\HardWare_QC_UFS_TOOLS.exe"
  2⤵
  - Executes dropped EXE
  PID:3048

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

C:\Users\Admin\AppData\Local\Temp\HardWare_QC_UFS_TOOLS.exe

Filesize
7.0MB

MD5
baf72adce67a01875a3d16ed8bc36859

SHA1
0877d9bb86afa76308b9c93501efd10f45b83491

SHA256
9d45653a9f5276d42fa8c3770156890cd7e2e6e3d2f9366dd01654017dd799c3

SHA512
881dac92f8084eb71f8556658817b1eeed74dc04a4843fc8ff24fb5fddded72e8c114ee40de00fa541b9bdad7b2b0cb135624428d1ca85b58a8bc96fb65e3adc

Download Submit
\Users\Admin\AppData\Local\Temp\HardWare_QC_UFS_TOOLS.exe

Filesize
7.0MB

MD5
baf72adce67a01875a3d16ed8bc36859

SHA1
0877d9bb86afa76308b9c93501efd10f45b83491

SHA256
9d45653a9f5276d42fa8c3770156890cd7e2e6e3d2f9366dd01654017dd799c3

SHA512
881dac92f8084eb71f8556658817b1eeed74dc04a4843fc8ff24fb5fddded72e8c114ee40de00fa541b9bdad7b2b0cb135624428d1ca85b58a8bc96fb65e3adc

Download Submit
memory/2468-8-0x0000000003BD0000-0x0000000004659000-memory.dmp

Filesize
10.5MB

Download
memory/3048-7-0x0000000000020000-0x0000000000021000-memory.dmp

Filesize
4KB

Download
memory/3048-10-0x0000000000400000-0x0000000000E89000-memory.dmp

Filesize
10.5MB

Download