ed04df376e127f7c735e8f81a73a8c74294daad91bc3231d61034f19f1d4e9a4

Analysis

max time kernel
121s
max time network
130s
platform
windows7_x64
resource
win7-20230831-en
resource tags

arch:x64arch:x86image:win7-20230831-enlocale:en-usos:windows7-x64system
submitted
14-10-2023 01:59

Target

HDFC_0714.exe
Size

2.8MB
MD5

13b1d6257b39fc71cc97e16d98d5a9f8
SHA1

31ee10c6a4e7d919dcb8d4333a9516376365792f
SHA256

104bdcceeb0a98bbeab3ae52100a5bd31a4fe7fa2b832ce36aa08c735be83227
SHA512

a9826ca280f296ee33c5d3a822eba7c3f5bdd0f0f8e5390b83e6ebb752ad84b616a2b9b25af8ce09898bbec0227113e27dc8fc862852132c71fa498589a51ab3
SSDEEP

49152:daozWskWk5cS7a+9XYaQ8Zehc4mTYJ78V9gyBn4cYfmP/SA8NEW:fzWsajJPZ942KQV9hp4XfmP/SA82W

Score

3^/10

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082
Suspicious use of SetWindowsHookEx 3 IoCs

Processes:

HDFC_0714.exe

pid process

2068 HDFC_0714.exe
2068 HDFC_0714.exe
2068 HDFC_0714.exe

Suspicious use of WriteProcessMemory 4 IoCs

Processes:

HDFC_0714.exe

description	pid	process	target process
PID 2068 wrote to memory of 2184	2068	HDFC_0714.exe	cmd.exe
PID 2068 wrote to memory of 2184	2068	HDFC_0714.exe	cmd.exe
PID 2068 wrote to memory of 2184	2068	HDFC_0714.exe	cmd.exe
PID 2068 wrote to memory of 2184	2068	HDFC_0714.exe	cmd.exe

C:\Users\Admin\AppData\Local\Temp\HDFC_0714.exe
"C:\Users\Admin\AppData\Local\Temp\HDFC_0714.exe"
1⤵
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2068
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c C:\Users\Admin\AppData\Local\Temp\
  2⤵
  PID:2184

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact