208ec739072925c9c23ec8f7ab27168acfa9c63dc15d32dddd9a4d3c83116b97

Analysis

max time kernel
118s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20231222-en
resource tags

arch:x64arch:x86image:win10v2004-20231222-enlocale:en-usos:windows10-2004-x64system
submitted
29/01/2024, 11:27

Target

7fb9b5d6c809318c0f4757ba245f6302.exe
Size

598KB
MD5

7fb9b5d6c809318c0f4757ba245f6302
SHA1

037a18b0fc5656f1714b59628249fc6b20b3af57
SHA256

208ec739072925c9c23ec8f7ab27168acfa9c63dc15d32dddd9a4d3c83116b97
SHA512

8fbf569e05bd748bc44681230c84049a9f5f3c5d9fa398338f313353e1ef3ce193187ea7949c239b7d369bae616dbf464a0916ba5365798566ff36abd2b542c0
SSDEEP

6144:rhYsafa0idunTIPDan9xTy2VTk0xfdI3QPTYiEYKB6eTBh+:rWlfiunTIe9hTk0xlI30TYUHeT

Score

7^/10

Executes dropped EXE 1 IoCs

pid	Process
4512	svchost.exe

Drops file in Windows directory 4 IoCs

description	ioc	Process
File created	C:\Windows\PxsQWQ\yOEMapej.dll	svchost.exe
File opened for modification	C:\Windows\PxsQWQ\yOEMapej.dll	svchost.exe
File created	C:\Windows\mUCKEPOb.dll	7fb9b5d6c809318c0f4757ba245f6302.exe
File created	C:\Windows\aWQEKR.dll	svchost.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2132	4512	WerFault.exe	76

Suspicious behavior: EnumeratesProcesses 6 IoCs

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2772 wrote to memory of 4512	2772	7fb9b5d6c809318c0f4757ba245f6302.exe	76
PID 2772 wrote to memory of 4512	2772	7fb9b5d6c809318c0f4757ba245f6302.exe	76
PID 2772 wrote to memory of 4512	2772	7fb9b5d6c809318c0f4757ba245f6302.exe	76

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 416 -p 4512 -ip 4512
1⤵
PID:2444

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

C:\ProgramData\PULxfCSq\svchost.exe

Filesize
603KB

MD5
1d7f8ff71ede62e632ec8dd30fb0032d

SHA1
f84e4abf3bf72fa5ff26940b7e2edc5ca0d3b0b0

SHA256
2f928ed9bf3aeb7f5dd78e17d5b5c9cace73bb4961ad00ec787bfe31abbe8aba

SHA512
41945d44af746b4194066c1d5b8275ee22daa87589a623fd662f6dc15d7230e3b00075263dfa3976a475f8a904ccf733c3dc15e85086db0ddd67d639b7c38925

Download Submit
memory/2772-0-0x0000000000400000-0x000000000045D000-memory.dmp

Filesize
372KB

Download
memory/2772-9-0x0000000000400000-0x000000000045D000-memory.dmp

Filesize
372KB

Download
memory/4512-8-0x0000000000400000-0x000000000045D000-memory.dmp

Filesize
372KB

Download
memory/4512-12-0x0000000000400000-0x000000000045D000-memory.dmp

Filesize
372KB

Download
memory/4512-22-0x0000000000400000-0x000000000045D000-memory.dmp

Filesize
372KB

Download