1aa76587588dc3a0643733b8930176eedd9732ed31dafafdf545ead4741200e7

Analysis

max time kernel
121s
max time network
122s
platform
windows7_x64
resource
win7-20240215-en
resource tags

arch:x64arch:x86image:win7-20240215-enlocale:en-usos:windows7-x64system
submitted
09/03/2024, 21:08

Target

1aa76587588dc3a0643733b8930176eedd9732ed31dafafdf545ead4741200e7.exe
Size

448KB
MD5

411c8fa7d7b71729231ec23e62e023f9
SHA1

233eb141b5b030a4512962ad8ed6ef2bd458f0af
SHA256

1aa76587588dc3a0643733b8930176eedd9732ed31dafafdf545ead4741200e7
SHA512

5b61f8132560162e7660d9cb1e04c3481489927916d16cd03879f1b4781d2b7dd3270864bb0a9cecc36cb8f5bbffbc725d04037c1954077eece21e446510ec5d
SSDEEP

6144:n+GxFNcONazpuImOeqwsMV0f2ukEjWbjcSbcY+CaQdaFOY4iGFYtR:nbFwilukFbz+xt4vF

Score

7^/10

Executes dropped EXE 1 IoCs

pid	Process
2564	WKTBJ.exe

Loads dropped DLL 2 IoCs

pid	Process
1904	cmd.exe
1904	cmd.exe

Drops file in System32 directory 3 IoCs

description	ioc	Process
File created	C:\windows\SysWOW64\WKTBJ.exe	1aa76587588dc3a0643733b8930176eedd9732ed31dafafdf545ead4741200e7.exe
File opened for modification	C:\windows\SysWOW64\WKTBJ.exe	1aa76587588dc3a0643733b8930176eedd9732ed31dafafdf545ead4741200e7.exe
File created	C:\windows\SysWOW64\WKTBJ.exe.bat	1aa76587588dc3a0643733b8930176eedd9732ed31dafafdf545ead4741200e7.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
3012	1aa76587588dc3a0643733b8930176eedd9732ed31dafafdf545ead4741200e7.exe
2564	WKTBJ.exe

Suspicious use of SetWindowsHookEx 4 IoCs

pid	Process
3012	1aa76587588dc3a0643733b8930176eedd9732ed31dafafdf545ead4741200e7.exe
3012	1aa76587588dc3a0643733b8930176eedd9732ed31dafafdf545ead4741200e7.exe
2564	WKTBJ.exe
2564	WKTBJ.exe

Suspicious use of WriteProcessMemory 8 IoCs

description	pid	Process	procid_target
PID 3012 wrote to memory of 1904	3012	1aa76587588dc3a0643733b8930176eedd9732ed31dafafdf545ead4741200e7.exe	28
PID 3012 wrote to memory of 1904	3012	1aa76587588dc3a0643733b8930176eedd9732ed31dafafdf545ead4741200e7.exe	28
PID 3012 wrote to memory of 1904	3012	1aa76587588dc3a0643733b8930176eedd9732ed31dafafdf545ead4741200e7.exe	28
PID 3012 wrote to memory of 1904	3012	1aa76587588dc3a0643733b8930176eedd9732ed31dafafdf545ead4741200e7.exe	28
PID 1904 wrote to memory of 2564	1904	cmd.exe	30
PID 1904 wrote to memory of 2564	1904	cmd.exe	30
PID 1904 wrote to memory of 2564	1904	cmd.exe	30
PID 1904 wrote to memory of 2564	1904	cmd.exe	30

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

C:\Windows\SysWOW64\WKTBJ.exe.bat

Filesize
74B

MD5
783c4cbcc220360b1275bb54f8af9172

SHA1
b8b86fb5290b819bd700220ecf267678dafbc49e

SHA256
e36c43798fff7a9a17c9ab0c1d227fc9a049e220d8ee33f93ce87600d4477fbc

SHA512
06637389b47d07894e9aaa1ae16e1ab58516a6f404e914e1d41e666b26cec8431823105e51bea9896a79b698b9a7ee2fb276411a8ce7697b9e45694d77b285ba

Download Submit
\Windows\SysWOW64\WKTBJ.exe

Filesize
448KB

MD5
2b444b6a71d63533d0e1090a2dfd9f68

SHA1
6286d9dc785df4d9dc7bf344e4770148289beece

SHA256
4e8493fdb17118073080ac7916909c57cf5faf1eba2df8f4aee24aa422ff10cf

SHA512
961a8c14499f835da350bee30f4befcfe68bed52a9aed16c1dfaf805f9949558e8403bd4362ff5635bb3eedef4e7ee93bcf04cd132d0c177e8ce1c44ab67009f

Download Submit
memory/1904-18-0x0000000000540000-0x0000000000578000-memory.dmp

Filesize
224KB

Download
memory/1904-19-0x0000000000540000-0x0000000000578000-memory.dmp

Filesize
224KB

Download
memory/2564-20-0x0000000000400000-0x0000000000438000-memory.dmp

Filesize
224KB

Download
memory/2564-21-0x0000000000400000-0x0000000000438000-memory.dmp

Filesize
224KB

Download
memory/3012-0-0x0000000000400000-0x0000000000438000-memory.dmp

Filesize
224KB

Download
memory/3012-12-0x0000000000400000-0x0000000000438000-memory.dmp

Filesize
224KB

Download