1aabc291b910d51719c3f0fe074f4f284c160796d10d4d2a46acb3c64239449e

Analysis

max time kernel
122s
max time network
130s
platform
windows7_x64
resource
win7-20231023-en
resource tags

arch:x64arch:x86image:win7-20231023-enlocale:en-usos:windows7-x64system
submitted
01/11/2023, 12:36

Target

20557d8b534b624b67bc6c659519d1e2.exe
Size

128KB
MD5

20557d8b534b624b67bc6c659519d1e2
SHA1

721fe4138bf30bb457be01de4fa02effe891db09
SHA256

633b04aa2a794fab5b0e23cb77b1d7a2bc2d69b1f2ec258b02317060d5731681
SHA512

df630b5b5fde0f6d50e17b5689b13a5c83cd08a6b5e78ced65519bfa976a61463ed6b640b6976ac266b35307cb0a7d44dc4637509e71c5bb984bcc736bb3c83f
SSDEEP

768:AggEakQhT9VmoVK/bHUyhDWIKT5Ydf9QuDdwzXik7RNi3CVL:takQhTjT4/b1hDWSUFDTlNpl

Score

3^/10

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2632	1956	WerFault.exe	11

Suspicious behavior: EnumeratesProcesses 1 IoCs

pid	Process
1288	powershell.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	1288	powershell.exe
Token: SeDebugPrivilege	1956	20557d8b534b624b67bc6c659519d1e2.exe

Suspicious use of WriteProcessMemory 8 IoCs

description	pid	Process	procid_target
PID 1956 wrote to memory of 1288	1956	20557d8b534b624b67bc6c659519d1e2.exe	28
PID 1956 wrote to memory of 1288	1956	20557d8b534b624b67bc6c659519d1e2.exe	28
PID 1956 wrote to memory of 1288	1956	20557d8b534b624b67bc6c659519d1e2.exe	28
PID 1956 wrote to memory of 1288	1956	20557d8b534b624b67bc6c659519d1e2.exe	28
PID 1956 wrote to memory of 2632	1956	20557d8b534b624b67bc6c659519d1e2.exe	32
PID 1956 wrote to memory of 2632	1956	20557d8b534b624b67bc6c659519d1e2.exe	32
PID 1956 wrote to memory of 2632	1956	20557d8b534b624b67bc6c659519d1e2.exe	32
PID 1956 wrote to memory of 2632	1956	20557d8b534b624b67bc6c659519d1e2.exe	32

C:\Users\Admin\AppData\Local\Temp\20557d8b534b624b67bc6c659519d1e2.exe
"C:\Users\Admin\AppData\Local\Temp\20557d8b534b624b67bc6c659519d1e2.exe"
1⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1956
- C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -enc UwB0AEEAcgB0AC0AUwBsAEUAZQBQACAALQBzACAAMgAwAA==
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:1288
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 1956 -s 1120
  2⤵
  - Program crash
  PID:2632

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

memory/1288-4-0x00000000715C0000-0x0000000071B6B000-memory.dmp

Filesize
5.7MB

Download
memory/1288-5-0x00000000715C0000-0x0000000071B6B000-memory.dmp

Filesize
5.7MB

Download
memory/1288-6-0x00000000022C0000-0x0000000002300000-memory.dmp

Filesize
256KB

Download
memory/1288-7-0x00000000022C0000-0x0000000002300000-memory.dmp

Filesize
256KB

Download
memory/1288-9-0x00000000715C0000-0x0000000071B6B000-memory.dmp

Filesize
5.7MB

Download
memory/1288-10-0x00000000715C0000-0x0000000071B6B000-memory.dmp

Filesize
5.7MB

Download
memory/1956-0-0x0000000001190000-0x00000000011B6000-memory.dmp

Filesize
152KB

Download
memory/1956-1-0x0000000074520000-0x0000000074C0E000-memory.dmp

Filesize
6.9MB

Download
memory/1956-8-0x0000000074520000-0x0000000074C0E000-memory.dmp

Filesize
6.9MB

Download
memory/1956-11-0x0000000005570000-0x00000000055B0000-memory.dmp

Filesize
256KB

Download
memory/1956-12-0x0000000005570000-0x00000000055B0000-memory.dmp

Filesize
256KB

Download