1245b2a19816985f5667ef344b760c1a2eb71683f457a58180cfc6ea2d42b416

Analysis

max time kernel
140s
max time network
122s
platform
windows7_x64
resource
win7-20231129-en
resource tags

arch:x64arch:x86image:win7-20231129-enlocale:en-usos:windows7-x64system
submitted
31/12/2023, 03:28

Target

2665be2a0c1b649921dff2e915388457.exe
Size

3.4MB
MD5

2665be2a0c1b649921dff2e915388457
SHA1

2bb5905d8fa754b834214cdb85a58db098721897
SHA256

1245b2a19816985f5667ef344b760c1a2eb71683f457a58180cfc6ea2d42b416
SHA512

fc45c6fc2e9e6f4166ace9aaa5359638e428862e23221a56aff7fbbddf0d10beb09757c062d251c7f935ae691a49f559d89cd8cb7763213c2c1c86b731496833
SSDEEP

98304:aJDC5ue1FbbzvD0ECIJ457WIPXpiqGxGVNebSivZnH:aJ+5ue1FbvvwECIa5dP5Uwe2UZ

Score

7^/10

Executes dropped EXE 1 IoCs

pid	Process
2316	2665be2a0c1b649921dff2e915388457.tmp

Loads dropped DLL 4 IoCs

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
2316	2665be2a0c1b649921dff2e915388457.tmp
2316	2665be2a0c1b649921dff2e915388457.tmp

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
2316	2665be2a0c1b649921dff2e915388457.tmp

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2732 wrote to memory of 2316	2732	2665be2a0c1b649921dff2e915388457.exe	16
PID 2732 wrote to memory of 2316	2732	2665be2a0c1b649921dff2e915388457.exe	16
PID 2732 wrote to memory of 2316	2732	2665be2a0c1b649921dff2e915388457.exe	16
PID 2732 wrote to memory of 2316	2732	2665be2a0c1b649921dff2e915388457.exe	16
PID 2732 wrote to memory of 2316	2732	2665be2a0c1b649921dff2e915388457.exe	16
PID 2732 wrote to memory of 2316	2732	2665be2a0c1b649921dff2e915388457.exe	16
PID 2732 wrote to memory of 2316	2732	2665be2a0c1b649921dff2e915388457.exe	16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

\Users\Admin\AppData\Local\Temp\is-J8HSE.tmp\2665be2a0c1b649921dff2e915388457.tmp

Filesize
92KB

MD5
9fdeefe923d7ac3d9f222159cc22f5e1

SHA1
a3af0d9c8f3e29e0ec2a1acc7f4ffc643dbddb1b

SHA256
3fd90d3e0fd6ff1e8c59596d7cae5001e16cd4ba2c39049756fea448b3da6368

SHA512
d9beeb18014382319d53567f028064915ae18fe6a8b2e3fe2db3b22886ec8a795ca0d6c9c1604195387fb83df5d7e9f235f04dc99ca01742c96a18485f150e66

Download Submit
memory/2316-9-0x00000000003C0000-0x00000000003C1000-memory.dmp

Filesize
4KB

Download
memory/2316-22-0x00000000037F0000-0x0000000003827000-memory.dmp

Filesize
220KB

Download
memory/2316-193-0x00000000037F0000-0x0000000003827000-memory.dmp

Filesize
220KB

Download
memory/2316-192-0x0000000000400000-0x0000000000536000-memory.dmp

Filesize
1.2MB

Download
memory/2316-197-0x00000000003C0000-0x00000000003C1000-memory.dmp

Filesize
4KB

Download
memory/2732-0-0x0000000000400000-0x0000000000418000-memory.dmp

Filesize
96KB

Download
memory/2732-2-0x0000000000400000-0x0000000000418000-memory.dmp

Filesize
96KB

Download
memory/2732-191-0x0000000000400000-0x0000000000418000-memory.dmp

Filesize
96KB

Download