79d352413ec91e3c74925718fd3a7e8d6f234d62a2ceffb6a1e7c5b257ec48e9

Analysis

max time kernel
168s
max time network
147s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
24/02/2024, 17:03

Target
$0/ILMinihostBridge64.exe
Size 3.0MB
Sample240224-vkn7eaha52
SHA256 305d88f08355250eb2c3db78213264ce5b6ef69b3990710d04ae1dea72a5919b
MD5 4226dc45950473419e8f3ef1503d27b3
SHA1 9e7de1cc2a8d8066dca588672a43bf79abbd863b
SHA512 55c3972f77f565c8d93f1ab1fc6c1a1097851e90be6eab48494c58a85c14020f78f71b495f8deb1d5e99b4c9c4409d524ff50b265346bc2da5067f830a7a2762
SSDEEP 24576:777Pbvc6pEyjLZ1J1BHutiTvFHdQ0PIMayFr7+3+hNkDT7N+dBKJe3/0:zjbhZwiDbhKyF/+uUDT1JI/0
MD5 SHA1 SHA512 SSDEEP

Score

3^/10

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2452	ILMinihostBridge64.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2452 wrote to memory of 2444	2452	ILMinihostBridge64.exe	29
PID 2452 wrote to memory of 2444	2452	ILMinihostBridge64.exe	29
PID 2452 wrote to memory of 2444	2452	ILMinihostBridge64.exe	29

C:\Users\Admin\AppData\Local\Temp\$0\ILMinihostBridge64.exe
"C:\Users\Admin\AppData\Local\Temp\$0\ILMinihostBridge64.exe"
1⤵
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
PID:2452
- C:\Users\Admin\AppData\Local\Temp\$0\ILMinihostBridge64.exe
  C:\Users\Admin\AppData\Local\Temp\$0\ILMinihostBridge64.exe Bridge7a7fe277ff4a82499fb472a4d63cc79b Bridgeb877af61377d8d4ca51eab6d432a43b3 "c:\program files (x86)\vstplugins\tal-bassline.dll" no
  2⤵
  PID:2444

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact