cc8983b7309b663c1c72075936be3f57cd11b602d4f60e7a642c709823bbf294

Analysis

max time kernel
120s
max time network
125s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
28/02/2024, 21:23

Target

DrBoan.exe
Size

5.2MB
MD5

5656aee6cd4d9a76af801468af57b82c
SHA1

5048f5256f5bea433eb00d17762308504406104c
SHA256

4d443cf4541e8ceb71504ee0e192cc42361e1e2a225bc4450d1b259a18d31d42
SHA512

8e5153eeb6f930d2675d0ec13d18792497bad06a09a05fd9595fffc5741e89c6ef38e5bedaa0d151e072861c8d8fdb34e81b8da9a3943348e274ed55d10516c3
SSDEEP

24576:fGAAL2tujT8eWZ/kkSKjMEdhusdNcbCskoA1J0O7Xeh0+K0XP1I:VI2tuEek/SK4oYIybCs9guUXeh0+K0dI

Score

3^/10

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
2088	DrBoan.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2088 wrote to memory of 1368	2088	DrBoan.exe	28
PID 2088 wrote to memory of 1368	2088	DrBoan.exe	28
PID 2088 wrote to memory of 1368	2088	DrBoan.exe	28
PID 2088 wrote to memory of 1368	2088	DrBoan.exe	28

C:\Users\Admin\AppData\Local\Temp\DrBoan.exe
"C:\Users\Admin\AppData\Local\Temp\DrBoan.exe"
1⤵
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2088
- C:\Windows\SysWOW64\schtasks.exe
  "C:\Windows\System32\schtasks.exe" /tn:"DrBoan" /run
  2⤵
  PID:1368

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact