04be48a9c176516d3b6570f4694c4b652fde5562488a7874bfd73d8f549084eb

Analysis

max time kernel
1793s
max time network
1562s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
23/12/2023, 04:29

Target

Patch.exe
Size

7.6MB
MD5

997fbd9c6904a80b1851ee91a285e8ec
SHA1

05f98e956544089cbec9a46492862430ca3cd965
SHA256

04be48a9c176516d3b6570f4694c4b652fde5562488a7874bfd73d8f549084eb
SHA512

2ed4462fd19375f164b30b5d880e2e628a792defc69f1b802a81eedc6c2096b820910365cd4ed43282657f19a05e49e0474d336e1db863b4688651205b059a8a
SSDEEP

196608:tt+G8SB2ETVd/Rjk4Wt4trM4FKQ7YCIevw3:eGfB2ERd/RI404trM4Vkevw3

Score

3^/10

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious behavior: EnumeratesProcesses 1 IoCs

pid	Process
2332	Patch.exe

C:\Users\Admin\AppData\Local\Temp\Patch.exe
"C:\Users\Admin\AppData\Local\Temp\Patch.exe"
1⤵
- Suspicious behavior: EnumeratesProcesses
PID:2332

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

memory/2332-15-0x0000000000400000-0x0000000000478000-memory.dmp

Filesize
480KB

Download