4a32b7d3f5827b41199fc570e12c47eedc080780ba3054e134c165251e632279

Analysis

max time kernel
118s
max time network
120s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
29/12/2023, 18:24

Target

005e4842f6ed2bc1fd2ea6f7b678375e.exe
Size

12KB
MD5

005e4842f6ed2bc1fd2ea6f7b678375e
SHA1

e2a3ca7acdfb5f87c5b04a9fd1beeb6cd4528989
SHA256

4a32b7d3f5827b41199fc570e12c47eedc080780ba3054e134c165251e632279
SHA512

394b35dacb1802ae835f060a9da04287a3222a26261eb9cd7726cff78f6a56d9708edbeb6acc641fcd53b7f2a9d387da7131b50e44c8562b83db826942578706
SSDEEP

192:eM44mUhZetZKVaR/jVlOy/CYDQApzwOv95PObYC1dWGF9CPhZz6vnC:d44m67al7iYrpzww95PBOihZOvC

Score

7^/10

upx

UPX packed file 1 IoCs

Detects executables packed with UPX/modified UPX open source packer.

resource	yara_rule
behavioral1/memory/2532-1-0x0000000000400000-0x000000000040F000-memory.dmp	upx

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082
Runs net.exe

Suspicious behavior: EnumeratesProcesses 1 IoCs

pid	Process
2532	005e4842f6ed2bc1fd2ea6f7b678375e.exe

Suspicious use of AdjustPrivilegeToken 7 IoCs

Suspicious use of WriteProcessMemory 13 IoCs

description	pid	Process	procid_target
PID 2532 wrote to memory of 848	2532	005e4842f6ed2bc1fd2ea6f7b678375e.exe	14
PID 2532 wrote to memory of 848	2532	005e4842f6ed2bc1fd2ea6f7b678375e.exe	14
PID 2532 wrote to memory of 848	2532	005e4842f6ed2bc1fd2ea6f7b678375e.exe	14
PID 2532 wrote to memory of 848	2532	005e4842f6ed2bc1fd2ea6f7b678375e.exe	14
PID 848 wrote to memory of 2136	848	cmd.exe	15
PID 848 wrote to memory of 2136	848	cmd.exe	15
PID 848 wrote to memory of 2136	848	cmd.exe	15
PID 848 wrote to memory of 2136	848	cmd.exe	15
PID 2136 wrote to memory of 2244	2136	net.exe	16
PID 2136 wrote to memory of 2244	2136	net.exe	16
PID 2136 wrote to memory of 2244	2136	net.exe	16
PID 2136 wrote to memory of 2244	2136	net.exe	16
PID 2532 wrote to memory of 1216	2532	005e4842f6ed2bc1fd2ea6f7b678375e.exe	10

C:\Windows\SysWOW64\cmd.exe
"C:\Windows\system32\cmd.exe" /c net stop "NVIDIA Display Driver Service" >> NUL
1⤵
- Suspicious use of WriteProcessMemory
PID:848
- C:\Windows\SysWOW64\net.exe
  net stop "NVIDIA Display Driver Service"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2136
- - C:\Windows\SysWOW64\net1.exe
    C:\Windows\system32\net1 stop "NVIDIA Display Driver Service"
    3⤵
    PID:2244

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

memory/1216-2-0x0000000002D90000-0x0000000002D91000-memory.dmp

Filesize
4KB

Download
memory/2532-1-0x0000000000400000-0x000000000040F000-memory.dmp

Filesize
60KB

Download