f704b64466963f7c98a5b2596c75b684661648dd4e732e0a87885029806f767c

Analysis

max time kernel
119s
max time network
120s
platform
windows7_x64
resource
win7-20240215-en
resource tags

arch:x64arch:x86image:win7-20240215-enlocale:en-usos:windows7-x64system
submitted
05/03/2024, 19:24

Target

Launch SOTF Mod Menu.exe
Size

169KB
MD5

65fb023b8bdf6505ee5b614ede79cb0b
SHA1

d4745e9e7c82d7b67d13b75860270d94b5b3db56
SHA256

f704b64466963f7c98a5b2596c75b684661648dd4e732e0a87885029806f767c
SHA512

8b0671bff3111731e6db09a687180ec49a1f2a00b7b5a94dcd5125b3e59f8bfc3a1f7b6ff1b2ef26c55a3a69162537605d448c945027accf14e617c3ec29cc2e
SSDEEP

3072:oDz+6pLAjnERRFNN0RIvU/FLNgvGw+CjepoR+k/MWsXDt8vmLnI7Dar7:U+OWORVaIvUdBu7+k/MWSyuLnI7Dan

Score

3^/10

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious behavior: EnumeratesProcesses 1 IoCs

pid	Process
2152	Launch SOTF Mod Menu.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2152 wrote to memory of 2036	2152	Launch SOTF Mod Menu.exe	29
PID 2152 wrote to memory of 2036	2152	Launch SOTF Mod Menu.exe	29
PID 2152 wrote to memory of 2036	2152	Launch SOTF Mod Menu.exe	29

C:\Users\Admin\AppData\Local\Temp\Launch SOTF Mod Menu.exe
"C:\Users\Admin\AppData\Local\Temp\Launch SOTF Mod Menu.exe"
1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:2152
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c pause
  2⤵
  PID:2036

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact