3a7c4fc585d7834b5d4ec2bfe5786abb7346594248d76549f7832c54e1f4564f

General

Target

bf5623a196aeddfceae4ae87606df617.exe
Size

7.2MB
MD5

bf5623a196aeddfceae4ae87606df617
SHA1

3b9778dc4a754ad53813fe83fb5dd39adf3aac79
SHA256

3a7c4fc585d7834b5d4ec2bfe5786abb7346594248d76549f7832c54e1f4564f
SHA512

1f4cfac3382f327692bd84b4aa7d1487f5bff7bf02ccaf0c0c463e689fee075995209408c58c3c0b0344b43f69888d35fc26f10f9ba39909452b93744d3b40a4
SSDEEP

98304:NOj7QooZSUu/a2yW5uf2/3X88xn8MCTApYCPDxbQo0igIDQ:MQCZylf2/3p8xoNg3

Score

5^/10

Malware Config

Signatures

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 4888 set thread context of 2712	4888	bf5623a196aeddfceae4ae87606df617.exe	87

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
2712	bf5623a196aeddfceae4ae87606df617.exe
2712	bf5623a196aeddfceae4ae87606df617.exe

Suspicious use of SetWindowsHookEx 3 IoCs

pid	Process
4888	bf5623a196aeddfceae4ae87606df617.exe
2712	bf5623a196aeddfceae4ae87606df617.exe
2712	bf5623a196aeddfceae4ae87606df617.exe

Suspicious use of WriteProcessMemory 19 IoCs

description	pid	Process	procid_target
PID 4888 wrote to memory of 332	4888	bf5623a196aeddfceae4ae87606df617.exe	85
PID 4888 wrote to memory of 332	4888	bf5623a196aeddfceae4ae87606df617.exe	85
PID 4888 wrote to memory of 2712	4888	bf5623a196aeddfceae4ae87606df617.exe	87
PID 4888 wrote to memory of 2712	4888	bf5623a196aeddfceae4ae87606df617.exe	87
PID 4888 wrote to memory of 2712	4888	bf5623a196aeddfceae4ae87606df617.exe	87
PID 4888 wrote to memory of 2712	4888	bf5623a196aeddfceae4ae87606df617.exe	87
PID 4888 wrote to memory of 2712	4888	bf5623a196aeddfceae4ae87606df617.exe	87
PID 4888 wrote to memory of 2712	4888	bf5623a196aeddfceae4ae87606df617.exe	87
PID 4888 wrote to memory of 2712	4888	bf5623a196aeddfceae4ae87606df617.exe	87
PID 4888 wrote to memory of 2712	4888	bf5623a196aeddfceae4ae87606df617.exe	87
PID 4888 wrote to memory of 2712	4888	bf5623a196aeddfceae4ae87606df617.exe	87
PID 4888 wrote to memory of 2712	4888	bf5623a196aeddfceae4ae87606df617.exe	87
PID 4888 wrote to memory of 2712	4888	bf5623a196aeddfceae4ae87606df617.exe	87
PID 4888 wrote to memory of 2712	4888	bf5623a196aeddfceae4ae87606df617.exe	87
PID 4888 wrote to memory of 2712	4888	bf5623a196aeddfceae4ae87606df617.exe	87
PID 4888 wrote to memory of 2712	4888	bf5623a196aeddfceae4ae87606df617.exe	87
PID 4888 wrote to memory of 2712	4888	bf5623a196aeddfceae4ae87606df617.exe	87
PID 4888 wrote to memory of 2712	4888	bf5623a196aeddfceae4ae87606df617.exe	87
PID 4888 wrote to memory of 2712	4888	bf5623a196aeddfceae4ae87606df617.exe	87

C:\Users\Admin\AppData\Local\Temp\bf5623a196aeddfceae4ae87606df617.exe
"C:\Users\Admin\AppData\Local\Temp\bf5623a196aeddfceae4ae87606df617.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4888
- C:\Windows\splwow64.exe
  C:\Windows\splwow64.exe 12288
  2⤵
  PID:332
- C:\Users\Admin\AppData\Local\Temp\bf5623a196aeddfceae4ae87606df617.exe
  "C:\Users\Admin\AppData\Local\Temp\bf5623a196aeddfceae4ae87606df617.exe" ""
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of SetWindowsHookEx
  PID:2712

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k PrintWorkflow -s PrintWorkflowUserSvc
1⤵
PID:5024

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

1

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2712-19-0x0000000000400000-0x0000000000882000-memory.dmp

Filesize
4.5MB

Download
memory/2712-13-0x0000000000400000-0x0000000000882000-memory.dmp

Filesize
4.5MB

Download
memory/2712-2-0x0000000000400000-0x0000000000882000-memory.dmp

Filesize
4.5MB

Download
memory/2712-4-0x0000000000400000-0x0000000000882000-memory.dmp

Filesize
4.5MB

Download
memory/2712-5-0x0000000000400000-0x0000000000882000-memory.dmp

Filesize
4.5MB

Download
memory/2712-7-0x0000000000AF0000-0x0000000000AF1000-memory.dmp

Filesize
4KB

Download
memory/2712-12-0x0000000000AF0000-0x0000000000AF1000-memory.dmp

Filesize
4KB

Download
memory/2712-8-0x0000000000400000-0x0000000000882000-memory.dmp

Filesize
4.5MB

Download
memory/2712-9-0x0000000000400000-0x0000000000882000-memory.dmp

Filesize
4.5MB

Download
memory/2712-10-0x0000000000400000-0x0000000000882000-memory.dmp

Filesize
4.5MB

Download
memory/2712-1-0x0000000000400000-0x0000000000882000-memory.dmp

Filesize
4.5MB

Download
memory/2712-24-0x0000000000400000-0x0000000000882000-memory.dmp

Filesize
4.5MB

Download
memory/2712-17-0x0000000000400000-0x0000000000882000-memory.dmp

Filesize
4.5MB

Download
memory/2712-14-0x0000000000400000-0x0000000000882000-memory.dmp

Filesize
4.5MB

Download
memory/2712-15-0x0000000000400000-0x0000000000882000-memory.dmp

Filesize
4.5MB

Download
memory/2712-16-0x0000000000400000-0x0000000000882000-memory.dmp

Filesize
4.5MB

Download
memory/2712-11-0x0000000000400000-0x0000000000882000-memory.dmp

Filesize
4.5MB

Download
memory/2712-18-0x0000000000400000-0x0000000000882000-memory.dmp

Filesize
4.5MB

Download
memory/2712-23-0x0000000000400000-0x0000000000882000-memory.dmp

Filesize
4.5MB

Download
memory/2712-20-0x0000000000400000-0x0000000000882000-memory.dmp

Filesize
4.5MB

Download
memory/2712-21-0x0000000000400000-0x0000000000882000-memory.dmp

Filesize
4.5MB

Download
memory/2712-22-0x0000000000400000-0x0000000000882000-memory.dmp

Filesize
4.5MB

Download
memory/4888-0-0x0000000001110000-0x0000000001111000-memory.dmp

Filesize
4KB

Download
memory/4888-6-0x0000000000400000-0x0000000000AB7000-memory.dmp

Filesize
6.7MB

Download

Analysis

Sharing