08057d1b68c83812296c1d405f5b2d6bce994717fe10bc1edbb9c5ad808b00be

Analysis

max time kernel
152s
max time network
162s
platform
windows10-2004_x64
resource
win10v2004-20231215-en
resource tags

arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
submitted
25/12/2023, 00:13

Target

1c1409dae244146f5f12d3682600df78.exe
Size

6.0MB
MD5

1c1409dae244146f5f12d3682600df78
SHA1

e79a93409e50a4de2117c275858592bc0d661845
SHA256

08057d1b68c83812296c1d405f5b2d6bce994717fe10bc1edbb9c5ad808b00be
SHA512

47d1706df48c3de3ddbe1b0106b70ce2032981c7b0d3522c0af96f2e1e0b4b2d79a08d042b63535d56c406972c09609354e778c05a2f6e052640773968f15e50
SSDEEP

98304:/zeoDRJ/WoD1rHRk4srTRPnpRXQKaoVASgT4eg:be0Jv6TBvpRXxt+Seg

Score

5^/10

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 980 set thread context of 1116	980	1c1409dae244146f5f12d3682600df78.exe	91

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
1116	1c1409dae244146f5f12d3682600df78.exe
1116	1c1409dae244146f5f12d3682600df78.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
1116	1c1409dae244146f5f12d3682600df78.exe
1116	1c1409dae244146f5f12d3682600df78.exe

Suspicious use of WriteProcessMemory 17 IoCs

description	pid	Process	procid_target
PID 980 wrote to memory of 1116	980	1c1409dae244146f5f12d3682600df78.exe	91
PID 980 wrote to memory of 1116	980	1c1409dae244146f5f12d3682600df78.exe	91
PID 980 wrote to memory of 1116	980	1c1409dae244146f5f12d3682600df78.exe	91
PID 980 wrote to memory of 1116	980	1c1409dae244146f5f12d3682600df78.exe	91
PID 980 wrote to memory of 1116	980	1c1409dae244146f5f12d3682600df78.exe	91
PID 980 wrote to memory of 1116	980	1c1409dae244146f5f12d3682600df78.exe	91
PID 980 wrote to memory of 1116	980	1c1409dae244146f5f12d3682600df78.exe	91
PID 980 wrote to memory of 1116	980	1c1409dae244146f5f12d3682600df78.exe	91
PID 980 wrote to memory of 1116	980	1c1409dae244146f5f12d3682600df78.exe	91
PID 980 wrote to memory of 1116	980	1c1409dae244146f5f12d3682600df78.exe	91
PID 980 wrote to memory of 1116	980	1c1409dae244146f5f12d3682600df78.exe	91
PID 980 wrote to memory of 1116	980	1c1409dae244146f5f12d3682600df78.exe	91
PID 980 wrote to memory of 1116	980	1c1409dae244146f5f12d3682600df78.exe	91
PID 980 wrote to memory of 1116	980	1c1409dae244146f5f12d3682600df78.exe	91
PID 980 wrote to memory of 1116	980	1c1409dae244146f5f12d3682600df78.exe	91
PID 980 wrote to memory of 1116	980	1c1409dae244146f5f12d3682600df78.exe	91
PID 980 wrote to memory of 1116	980	1c1409dae244146f5f12d3682600df78.exe	91

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

memory/980-6-0x0000000000400000-0x00000000009D0000-memory.dmp

Filesize
5.8MB

Download
memory/980-0-0x00000000012D0000-0x00000000012D1000-memory.dmp

Filesize
4KB

Download
memory/1116-7-0x00000000028E0000-0x00000000028E1000-memory.dmp

Filesize
4KB

Download
memory/1116-5-0x0000000000400000-0x0000000000885000-memory.dmp

Filesize
4.5MB

Download
memory/1116-1-0x0000000000400000-0x0000000000885000-memory.dmp

Filesize
4.5MB

Download
memory/1116-4-0x0000000000400000-0x0000000000885000-memory.dmp

Filesize
4.5MB

Download
memory/1116-3-0x0000000000400000-0x0000000000885000-memory.dmp

Filesize
4.5MB

Download
memory/1116-8-0x0000000000400000-0x0000000000885000-memory.dmp

Filesize
4.5MB

Download
memory/1116-9-0x0000000000400000-0x0000000000885000-memory.dmp

Filesize
4.5MB

Download
memory/1116-10-0x0000000000400000-0x0000000000885000-memory.dmp

Filesize
4.5MB

Download
memory/1116-11-0x0000000000400000-0x0000000000885000-memory.dmp

Filesize
4.5MB

Download
memory/1116-12-0x0000000000400000-0x0000000000885000-memory.dmp

Filesize
4.5MB

Download
memory/1116-13-0x00000000028E0000-0x00000000028E1000-memory.dmp

Filesize
4KB

Download