72c29d9c210edf63cf98a767dee021dc7f006ece99121bbd1962742e17aa892f

Analysis

max time kernel
112s
max time network
149s
platform
windows10-2004_x64
resource
win10v2004-20231222-en
resource tags

arch:x64arch:x86image:win10v2004-20231222-enlocale:en-usos:windows10-2004-x64system
submitted
14-02-2024 06:49

Target

9b0994eba2a00e1f2433fec1c31126d3.exe
Size

689KB
MD5

9b0994eba2a00e1f2433fec1c31126d3
SHA1

8a2c9e1fb49cb178a32f07bc2af86123ce521b6d
SHA256

72c29d9c210edf63cf98a767dee021dc7f006ece99121bbd1962742e17aa892f
SHA512

6bc8eefa3e19ef123a9c9a03f72fa8dd6fe8e44bbbe844ace619f0c00ad0d96366e03a2189b78e98ecb4f524582aba6179d8f931f83b32a9d469827143af0008
SSDEEP

6144:oJ82asJfnlAJwT71w+DtmVlTWw8oY4JHfTcE6sTNrCMHJeTBh+:oOWJ8wT7SoScCY4JHLcElTNm8eT

Score

7^/10

Executes dropped EXE 1 IoCs

pid	Process
2960	svchost.exe

Drops file in Windows directory 4 IoCs

description	ioc	Process
File created	C:\Windows\OKdCECFL.dll	9b0994eba2a00e1f2433fec1c31126d3.exe
File created	C:\Windows\HQmEUkrW.dll	svchost.exe
File created	C:\Windows\LgOvSDD\fTxoNog.dll	svchost.exe
File opened for modification	C:\Windows\LgOvSDD\fTxoNog.dll	svchost.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2012	2960	WerFault.exe	83

Suspicious behavior: EnumeratesProcesses 6 IoCs

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2044 wrote to memory of 2960	2044	9b0994eba2a00e1f2433fec1c31126d3.exe	83
PID 2044 wrote to memory of 2960	2044	9b0994eba2a00e1f2433fec1c31126d3.exe	83
PID 2044 wrote to memory of 2960	2044	9b0994eba2a00e1f2433fec1c31126d3.exe	83

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 436 -p 2960 -ip 2960
1⤵
PID:4528

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

C:\Users\Admin\AppData\Local\Temp\VDpEmUPw\svchost.exe

Filesize
693KB

MD5
f74672db80ba11331f82e40dcf20981d

SHA1
55139ea51f252bbc245b9a4f8fa628348579726a

SHA256
2c6f56d33cda89fd5e9542e9032bab3235127300d210cc75d8ea31570dabdad8

SHA512
0ce4d353fa982abdaaff49dc126cbd9ddb1f26ecd1ce9c38b6a9d86fcbfcbe06d74f3001f1e21b55506ebb016369155fe2e289192d96c7814901cf11ef1d9115

Download Submit
memory/2044-0-0x0000000000400000-0x0000000000460000-memory.dmp

Filesize
384KB

Download
memory/2044-11-0x0000000000400000-0x0000000000460000-memory.dmp

Filesize
384KB

Download
memory/2960-8-0x0000000000400000-0x0000000000460000-memory.dmp

Filesize
384KB

Download
memory/2960-12-0x0000000000400000-0x0000000000460000-memory.dmp

Filesize
384KB

Download
memory/2960-22-0x0000000000400000-0x0000000000460000-memory.dmp

Filesize
384KB

Download