e806643f2442720f3b5e94537d33b10878647c727570ae5317336a018ce62ddc

Analysis

max time kernel
143s
max time network
149s
platform
windows10-2004_x64
resource
win10v2004-20231215-en
resource tags

arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
submitted
09-02-2024 03:54

Target

1077f50c3d3493b3ea916b7dac608ca5de82c02e8bfc95386d5fe4615cfa85bd.exe
Size

15.7MB
MD5

c4f4a82eeac84a8a0f60996c2e796291
SHA1

5055cd3395e78cc91b563cfd1d2e96f652349851
SHA256

1077f50c3d3493b3ea916b7dac608ca5de82c02e8bfc95386d5fe4615cfa85bd
SHA512

6df3aa2d4cd26b9cb407353b918d49c3e71b7d94671c2a9514b9c1eebff02e12dfe2856bbd4f2d51291700a8900851f6cc9a1fb84dee94974542131359577fff
SSDEEP

393216:9rCac/7QOYZqCMMY2VuNtEOfQsHQ1vNVmy/bJubM:9rCac/7dYfMMQtTfI1vTmyDj

Score

7^/10

Executes dropped EXE 1 IoCs

Processes:

1077f50c3d3493b3ea916b7dac608ca5de82c02e8bfc95386d5fe4615cfa85bd.tmp

pid process

1208 1077f50c3d3493b3ea916b7dac608ca5de82c02e8bfc95386d5fe4615cfa85bd.tmp
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

pid	process
1208	1077f50c3d3493b3ea916b7dac608ca5de82c02e8bfc95386d5fe4615cfa85bd.tmp

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

1077f50c3d3493b3ea916b7dac608ca5de82c02e8bfc95386d5fe4615cfa85bd.exe

description	pid	process	target process
PID 1416 wrote to memory of 1208	1416	1077f50c3d3493b3ea916b7dac608ca5de82c02e8bfc95386d5fe4615cfa85bd.exe	1077f50c3d3493b3ea916b7dac608ca5de82c02e8bfc95386d5fe4615cfa85bd.tmp
PID 1416 wrote to memory of 1208	1416	1077f50c3d3493b3ea916b7dac608ca5de82c02e8bfc95386d5fe4615cfa85bd.exe	1077f50c3d3493b3ea916b7dac608ca5de82c02e8bfc95386d5fe4615cfa85bd.tmp
PID 1416 wrote to memory of 1208	1416	1077f50c3d3493b3ea916b7dac608ca5de82c02e8bfc95386d5fe4615cfa85bd.exe	1077f50c3d3493b3ea916b7dac608ca5de82c02e8bfc95386d5fe4615cfa85bd.tmp

C:\Users\Admin\AppData\Local\Temp\1077f50c3d3493b3ea916b7dac608ca5de82c02e8bfc95386d5fe4615cfa85bd.exe
"C:\Users\Admin\AppData\Local\Temp\1077f50c3d3493b3ea916b7dac608ca5de82c02e8bfc95386d5fe4615cfa85bd.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1416

C:\Users\Admin\AppData\Local\Temp\is-BA5TI.tmp\1077f50c3d3493b3ea916b7dac608ca5de82c02e8bfc95386d5fe4615cfa85bd.tmp
"C:\Users\Admin\AppData\Local\Temp\is-BA5TI.tmp\1077f50c3d3493b3ea916b7dac608ca5de82c02e8bfc95386d5fe4615cfa85bd.tmp" /SL5="$A0064,16107430,53248,C:\Users\Admin\AppData\Local\Temp\1077f50c3d3493b3ea916b7dac608ca5de82c02e8bfc95386d5fe4615cfa85bd.exe"
2⤵
- Executes dropped EXE
PID:1208

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

C:\Users\Admin\AppData\Local\Temp\is-BA5TI.tmp\1077f50c3d3493b3ea916b7dac608ca5de82c02e8bfc95386d5fe4615cfa85bd.tmp

Filesize
669KB

MD5
52950ac9e2b481453082f096120e355a

SHA1
159c09db1abcee9114b4f792ffba255c78a6e6c3

SHA256
25fbc88c7c967266f041ae4d47c2eae0b96086f9e440cca10729103aee7ef6cd

SHA512
5b61c28bbcaedadb3b6cd3bb8a392d18016c354c4c16e01395930666addc95994333dfc45bea1a1844f6f1585e79c729136d3714ac118b5848becde0bdb182ba

Download Submit
memory/1208-7-0x0000000000760000-0x0000000000761000-memory.dmp

Filesize
4KB

Download
memory/1208-16-0x0000000000400000-0x00000000004B6000-memory.dmp

Filesize
728KB

Download
memory/1208-19-0x0000000000760000-0x0000000000761000-memory.dmp

Filesize
4KB

Download
memory/1416-0-0x0000000000400000-0x0000000000414000-memory.dmp

Filesize
80KB

Download
memory/1416-2-0x0000000000400000-0x0000000000414000-memory.dmp

Filesize
80KB

Download
memory/1416-15-0x0000000000400000-0x0000000000414000-memory.dmp

Filesize
80KB

Download