2cb398ecd2ee5c6760a8fb2c9c70008e86ab077af14e1c417d064dc33e65ac74

Analysis

max time kernel
24s
max time network
18s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
11-03-2024 09:09

Target

DOM-04-INV-1616.exe
Size

2.4MB
MD5

c39e73033267ae166eaa5932507ef95b
SHA1

668cb060f6cdf86175c2b8d56198b5a4b2581d18
SHA256

2cb398ecd2ee5c6760a8fb2c9c70008e86ab077af14e1c417d064dc33e65ac74
SHA512

b3483ea1c12380676cef1a557aa67028155844de94fc49791a81e2a288d26739f4a6f9ad48942e133f452b7e5a296ff267c931a1faef9e73c11c2e9d7b421fca
SSDEEP

49152:cZehc4mTYJ78V9gyBn4cNkWk5cS7a+9XYaQyVRfmP/SA8N:cZ942KQV9hp4sajJvfmP/SA8

Score

3^/10

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious use of SetWindowsHookEx 3 IoCs

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1688 wrote to memory of 2228	1688	DOM-04-INV-1616.exe	28
PID 1688 wrote to memory of 2228	1688	DOM-04-INV-1616.exe	28
PID 1688 wrote to memory of 2228	1688	DOM-04-INV-1616.exe	28
PID 1688 wrote to memory of 2228	1688	DOM-04-INV-1616.exe	28

C:\Users\Admin\AppData\Local\Temp\DOM-04-INV-1616.exe
"C:\Users\Admin\AppData\Local\Temp\DOM-04-INV-1616.exe"
1⤵
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1688
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c C:\Users\Admin\AppData\Local\Temp\
  2⤵
  PID:2228

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact