bdceae0011ef605ed7ba17edd9d550dd9bd580e8b4f69ac7d3bc18ac59e2b8ac

max time kernel
835s
max time network
857s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
13/03/2024, 08:44

Sharing

Target

test - Copy - Copy (4).exe
Size

6KB
MD5

4634098fe194204dc03f967cc0b19cd6
SHA1

eaa58619c6cea9f148cec61ee504cd727b3e80d8
SHA256

a1070b8803e4243699a44a77e60a199282814495bc3bd94759c07021c0a6c70c
SHA512

64e97fac56a25daf99f8ee1a9f480acc8020d5da4eb96ea77022c9170f6300b7b5479fce86e3e7e088cdaabdf123b65872e09b0ae17f8f97ea2fe58b6ecf7a9d
SSDEEP

96:2Fb158Vgo4CVvAXklfZT8kYl9RxxgAVNb8ICcGKzNt:oMV1vAX+8kYDRxbLh4s

Score

3^/10

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2480 wrote to memory of 2604	2480	test - Copy - Copy (4).exe	29
PID 2480 wrote to memory of 2604	2480	test - Copy - Copy (4).exe	29
PID 2480 wrote to memory of 2604	2480	test - Copy - Copy (4).exe	29

C:\Users\Admin\AppData\Local\Temp\test - Copy - Copy (4).exe
"C:\Users\Admin\AppData\Local\Temp\test - Copy - Copy (4).exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2480
- C:\Windows\system32\cmd.exe
  cmd /c ""C:\Users\Admin\AppData\Local\Temp\Azsx5WDv.bat" "
  2⤵
  PID:2604

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

C:\Users\Admin\AppData\Local\Temp\Azsx5WDv.bat

Filesize
421B

MD5
67d11b392feb0ad59fc11ff3e79dfeee

SHA1
7df5785988cb76c4893773614572c93baaa18717

SHA256
69bcf6c4c959410d5857ac219600cec68035bd92e708c0bf7318eece8d5acb9d

SHA512
50835d7dccb22cbf052a64ce2dd50df97f726b1d2044ab0e55ba42a2874601b6fe064f84659f89ce079627d147cf49d9548b24b2160a17783b934c6793507f11

Download Submit
memory/2480-0-0x0000000000A70000-0x0000000000A78000-memory.dmp

Filesize
32KB

Download
memory/2480-1-0x000007FEF5460000-0x000007FEF5E4C000-memory.dmp

Filesize
9.9MB

Download
memory/2480-12-0x000007FEF5460000-0x000007FEF5E4C000-memory.dmp

Filesize
9.9MB

Download