de5dc23f9794ae3c2cf7ea102a50b3fbc4f1b54229ff87dce56c73a3fb1c1d03

Analysis

max time kernel
149s
max time network
134s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
25-12-2023 04:57

Target

0670adf6d934f2642d33220a1c6fa0d1.exe
Size

23.7MB
MD5

0670adf6d934f2642d33220a1c6fa0d1
SHA1

d2c12675ee8941071ed08f02f357fe30ca1e3e95
SHA256

de5dc23f9794ae3c2cf7ea102a50b3fbc4f1b54229ff87dce56c73a3fb1c1d03
SHA512

a487c1aca7cfc20a886edc92614f3287e134377d1cf63b436063666a37225c10311006793729ccba1858eb9f513d367e4a8136fa330fe63e89509ec66fb95e33
SSDEEP

393216:uaq/j0SymQc9B+7cwWc8MU3p7T+kZyZG/G7ISHpJBaopSXykI7sgDUjVq:uB/QSTQyB+72xh+2G7dHpo9gYjVq

Score

4^/10

Executes dropped EXE 2 IoCs

pid	Process
2316	0670adf6d934f2642d33220a1c6fa0d1.tmp
2812	setup.exe

Loads dropped DLL 4 IoCs

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious behavior: EnumeratesProcesses 4 IoCs

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	2316	0670adf6d934f2642d33220a1c6fa0d1.tmp

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2812	setup.exe

Suspicious use of WriteProcessMemory 14 IoCs

description	pid	Process	procid_target
PID 2056 wrote to memory of 2316	2056	0670adf6d934f2642d33220a1c6fa0d1.exe	28
PID 2056 wrote to memory of 2316	2056	0670adf6d934f2642d33220a1c6fa0d1.exe	28
PID 2056 wrote to memory of 2316	2056	0670adf6d934f2642d33220a1c6fa0d1.exe	28
PID 2056 wrote to memory of 2316	2056	0670adf6d934f2642d33220a1c6fa0d1.exe	28
PID 2056 wrote to memory of 2316	2056	0670adf6d934f2642d33220a1c6fa0d1.exe	28
PID 2056 wrote to memory of 2316	2056	0670adf6d934f2642d33220a1c6fa0d1.exe	28
PID 2056 wrote to memory of 2316	2056	0670adf6d934f2642d33220a1c6fa0d1.exe	28
PID 2316 wrote to memory of 2812	2316	0670adf6d934f2642d33220a1c6fa0d1.tmp	29
PID 2316 wrote to memory of 2812	2316	0670adf6d934f2642d33220a1c6fa0d1.tmp	29
PID 2316 wrote to memory of 2812	2316	0670adf6d934f2642d33220a1c6fa0d1.tmp	29
PID 2316 wrote to memory of 2812	2316	0670adf6d934f2642d33220a1c6fa0d1.tmp	29
PID 2316 wrote to memory of 2812	2316	0670adf6d934f2642d33220a1c6fa0d1.tmp	29
PID 2316 wrote to memory of 2812	2316	0670adf6d934f2642d33220a1c6fa0d1.tmp	29
PID 2316 wrote to memory of 2812	2316	0670adf6d934f2642d33220a1c6fa0d1.tmp	29

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

memory/2056-0-0x0000000000400000-0x000000000042C000-memory.dmp

Filesize
176KB

Download
memory/2056-150-0x0000000000400000-0x000000000042C000-memory.dmp

Filesize
176KB

Download
memory/2056-151-0x0000000000400000-0x000000000042C000-memory.dmp

Filesize
176KB

Download
memory/2316-7-0x0000000000240000-0x0000000000241000-memory.dmp

Filesize
4KB

Download
memory/2316-98-0x0000000000400000-0x0000000000531000-memory.dmp

Filesize
1.2MB

Download
memory/2812-41-0x00000000009E0000-0x00000000009E1000-memory.dmp

Filesize
4KB

Download
memory/2812-50-0x0000000004760000-0x0000000004761000-memory.dmp

Filesize
4KB

Download
memory/2812-51-0x00000000047E0000-0x00000000047E1000-memory.dmp

Filesize
4KB

Download
memory/2812-152-0x0000000000400000-0x00000000009C6000-memory.dmp

Filesize
5.8MB

Download
memory/2812-154-0x00000000009E0000-0x00000000009E1000-memory.dmp

Filesize
4KB

Download