05aed4f4dac0e6e8497e12a0ebef0a76c3d163fa6460b1c6fe99ad80b4ac1b4e

Analysis

max time kernel
119s
max time network
126s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
15-01-2024 01:35

Target

$EXEFILE.exe
Size

384KB
MD5

2b024546ff1b448e5eaf429d8de0bdc7
SHA1

7bb0baa6568e845362e93c6f5ebcb7ae2c19d391
SHA256

95ca4270b70aec18e1152e8d6f86ccd24ce6fc424663644b3d9f5e0ac30491c1
SHA512

257dac17622771ececa8a65c6fc9826cb1d5d32006f94593c62cbda9ec6c0953a71e9b13b38ada76a83ffba8beb6fc6327b49e91961313ff0813ef0c7d2ef58f
SSDEEP

6144:tez4E4v7/3ZReruAcA9lg/tdtQd5CLcSxXzvDf6:tesjj/CruHQELc0vr6

Score

4^/10

Drops file in Windows directory 2 IoCs

Processes:

$EXEFILE.exe

description	ioc	process
File created	C:\Windows\Microsoft.NET\Framework64\v2.0.50727\config\security.config.cch.new	$EXEFILE.exe
File created	C:\Windows\Microsoft.NET\Framework64\v2.0.50727\config\enterprisesec.config.cch.new	$EXEFILE.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082
Suspicious use of SetWindowsHookEx 2 IoCs

Processes:

$EXEFILE.exe

pid process

2932 $EXEFILE.exe
2932 $EXEFILE.exe

pid	process
2932	$EXEFILE.exe
2932	$EXEFILE.exe

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Resource Development

Reconnaissance

memory/2932-0-0x0000000000180000-0x000000000018C000-memory.dmp

Filesize
48KB

Download
memory/2932-1-0x000007FEF5F50000-0x000007FEF68ED000-memory.dmp

Filesize
9.6MB

Download
memory/2932-2-0x0000000000BB0000-0x0000000000C30000-memory.dmp

Filesize
512KB

Download
memory/2932-3-0x000007FEF5F50000-0x000007FEF68ED000-memory.dmp

Filesize
9.6MB

Download
memory/2932-4-0x0000000000BB0000-0x0000000000C30000-memory.dmp

Filesize
512KB

Download
memory/2932-6-0x0000000000BB0000-0x0000000000C30000-memory.dmp

Filesize
512KB

Download
memory/2932-5-0x0000000000BB0000-0x0000000000C30000-memory.dmp

Filesize
512KB

Download
memory/2932-7-0x0000000000BB0000-0x0000000000C30000-memory.dmp

Filesize
512KB

Download
memory/2932-8-0x0000000000BB0000-0x0000000000C30000-memory.dmp

Filesize
512KB

Download
memory/2932-14-0x000007FEF5F50000-0x000007FEF68ED000-memory.dmp

Filesize
9.6MB

Download