441116d55e97124a067207bf57483dd3462bccfb034e56c4152675b0dcb118e7

Analysis

max time kernel
150s
max time network
150s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
16-03-2024 15:13

Target

2C3542B5D9AB4EED2DD88CD74A02236A944AFD76E8717F65DCD544912229CA85.exe
Size

10KB
MD5

ffb938c96bb741d2d1dcc05930072926
SHA1

643508e98cd746eb91adb0b3a0096ff3d7497dad
SHA256

2c3542b5d9ab4eed2dd88cd74a02236a944afd76e8717f65dcd544912229ca85
SHA512

09c63015e0a6f1c97f657106d01c7a5399686039f75ccbd9a097544d458edee3ca094b24c1d075658bd34ef332deee5736711f0ac6f7ea273baa42dda5c18215
SSDEEP

192:xjpBKnwR27YRs/5+K/OUzbx/wz93ADv8Ei:NunwR2JQKZx/wz93ADUv

Score

7^/10

Executes dropped EXE 1 IoCs

Processes:

quip.exe

pid process

2308 quip.exe

pid	process
2308	quip.exe

Loads dropped DLL 2 IoCs

Processes:

2C3542B5D9AB4EED2DD88CD74A02236A944AFD76E8717F65DCD544912229CA85.exe

pid	process
2864	2C3542B5D9AB4EED2DD88CD74A02236A944AFD76E8717F65DCD544912229CA85.exe
2864	2C3542B5D9AB4EED2DD88CD74A02236A944AFD76E8717F65DCD544912229CA85.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious use of WriteProcessMemory 4 IoCs

Processes:

2C3542B5D9AB4EED2DD88CD74A02236A944AFD76E8717F65DCD544912229CA85.exe

description	pid	process	target process
PID 2864 wrote to memory of 2308	2864	2C3542B5D9AB4EED2DD88CD74A02236A944AFD76E8717F65DCD544912229CA85.exe	quip.exe
PID 2864 wrote to memory of 2308	2864	2C3542B5D9AB4EED2DD88CD74A02236A944AFD76E8717F65DCD544912229CA85.exe	quip.exe
PID 2864 wrote to memory of 2308	2864	2C3542B5D9AB4EED2DD88CD74A02236A944AFD76E8717F65DCD544912229CA85.exe	quip.exe
PID 2864 wrote to memory of 2308	2864	2C3542B5D9AB4EED2DD88CD74A02236A944AFD76E8717F65DCD544912229CA85.exe	quip.exe

C:\Users\Admin\AppData\Local\Temp\quip.exe
"C:\Users\Admin\AppData\Local\Temp\quip.exe"
2⤵
- Executes dropped EXE
PID:2308

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Resource Development

Reconnaissance

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\94308059B57B3142E455B38A6EB92015
Filesize
67KB

MD5
753df6889fd7410a2e9fe333da83a429

SHA1
3c425f16e8267186061dd48ac1c77c122962456e

SHA256
b42dc237e44cbc9a43400e7d3f9cbd406dbdefd62bfe87328f8663897d69df78

SHA512
9d56f79410ad0cf852c74c3ef9454e7ae86e80bdd6ff67773994b48ccac71142bcf5c90635da6a056e1406e81e64674db9584928e867c55b77b59e2851cf6444

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar3D17.tmp
Filesize
175KB

MD5
dd73cead4b93366cf3465c8cd32e2796

SHA1
74546226dfe9ceb8184651e920d1dbfb432b314e

SHA256
a6752b7851b591550e4625b832a393aabcc428de18d83e8593cd540f7d7cae22

SHA512
ce1bdd595065c94fa528badf4a6a8777893807d6789267612755df818ba6ffe55e4df429710aea29526ee4aa8ef20e25f2f05341da53992157d21ae032c0fb63

Download Submit
\Users\Admin\AppData\Local\Temp\quip.exe
Filesize
10KB

MD5
449f04bcad9295c27ca50f5facde547a

SHA1
c7b26368f54017c46cf0da9d9f04ed84bfd513f8

SHA256
3c27ff04fccaa40620355e5c37446a33e22271c5de5f3ccaa2bfccc8b99081d8

SHA512
33ee9f3fe977cec4d225e1228c405b52700a5b07486b718aa5f0e2a6fe367d5f640543eac3eebf4583500856da47849467355d8d5b786e8e740442464c2fa519

Download Submit