6db9f6442d46fbde0953f8bfbc36bd714e5e31a62f927563594cafd60724d3e0

Analysis

max time kernel
118s
max time network
130s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
20/02/2024, 20:59

Target

$_32_/Setup.exe
Size

294KB
MD5

2f08d63bd6a6b8ab242cf87c5fd310a0
SHA1

2373187db907db948705f4b78c280f1bc945ac40
SHA256

5d5ccf2a4184d5413ea4c00c64f03cfb3f0c9b8ccb9d308994088118c75497fc
SHA512

191437f8155cfebc465690f4763de5f4ade16fd9888683749eec6590fa4787a496895765e4ba1b4382c0d1169a7c67e34fccb8e8edc0a245e9042cf82f643460
SSDEEP

3072:DTgJTZbFhC3etai/5FAvIYN28LyKVHeaMe4zO4rRKkuFjc9Erm4ZhQ21t5FAvIYB:0bS65FJOv35FJOv8Pc

Score

3^/10

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
2152	MSetup.exe
2152	MSetup.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2480 wrote to memory of 2152	2480	Setup.exe	28
PID 2480 wrote to memory of 2152	2480	Setup.exe	28
PID 2480 wrote to memory of 2152	2480	Setup.exe	28
PID 2480 wrote to memory of 2152	2480	Setup.exe	28
PID 2480 wrote to memory of 2152	2480	Setup.exe	28
PID 2480 wrote to memory of 2152	2480	Setup.exe	28
PID 2480 wrote to memory of 2152	2480	Setup.exe	28

C:\Users\Admin\AppData\Local\Temp\$_32_\Setup.exe
"C:\Users\Admin\AppData\Local\Temp\$_32_\Setup.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2480
- C:\Users\Admin\AppData\Local\Temp\$_32_\MSetup.exe
  "C:\Users\Admin\AppData\Local\Temp\$_32_\MSetup.exe"
  2⤵
  - Suspicious use of SetWindowsHookEx
  PID:2152

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact