aebcd4f236369977e1c6fd9307eca7beff9f405d788f6a158ffe4a4a8870d8c4

Analysis

max time kernel
121s
max time network
123s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
19/03/2024, 23:40

Target

aebcd4f236369977e1c6fd9307eca7beff9f405d788f6a158ffe4a4a8870d8c4.exe
Size

320KB
MD5

8595e2ca3dc56d16c38d4f140c039748
SHA1

db425e51f9ea205dd6a58ec6e40b498ffec32b88
SHA256

aebcd4f236369977e1c6fd9307eca7beff9f405d788f6a158ffe4a4a8870d8c4
SHA512

95dd167479694ea8e54e30d9a87098190ba727e8341b14d7a34a3d9d67ec75b1a424a8bfefae66968cb86e90c2faeaa51116be30ffdc9b477b11dd45a039b63d
SSDEEP

6144:hmd9Vmi7m+pbKbvP4uqHkEjWbjcSbcY+CA:hmdKwpbq1IkFbzs

Score

7^/10

Executes dropped EXE 1 IoCs

pid	Process
2596	JVTFTM.exe

Loads dropped DLL 2 IoCs

pid	Process
3056	cmd.exe
3056	cmd.exe

Drops file in System32 directory 3 IoCs

description	ioc	Process
File created	C:\windows\SysWOW64\JVTFTM.exe	aebcd4f236369977e1c6fd9307eca7beff9f405d788f6a158ffe4a4a8870d8c4.exe
File opened for modification	C:\windows\SysWOW64\JVTFTM.exe	aebcd4f236369977e1c6fd9307eca7beff9f405d788f6a158ffe4a4a8870d8c4.exe
File created	C:\windows\SysWOW64\JVTFTM.exe.bat	aebcd4f236369977e1c6fd9307eca7beff9f405d788f6a158ffe4a4a8870d8c4.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
2292	aebcd4f236369977e1c6fd9307eca7beff9f405d788f6a158ffe4a4a8870d8c4.exe
2596	JVTFTM.exe

Suspicious use of SetWindowsHookEx 4 IoCs

pid	Process
2292	aebcd4f236369977e1c6fd9307eca7beff9f405d788f6a158ffe4a4a8870d8c4.exe
2292	aebcd4f236369977e1c6fd9307eca7beff9f405d788f6a158ffe4a4a8870d8c4.exe
2596	JVTFTM.exe
2596	JVTFTM.exe

Suspicious use of WriteProcessMemory 8 IoCs

description	pid	Process	procid_target
PID 2292 wrote to memory of 3056	2292	aebcd4f236369977e1c6fd9307eca7beff9f405d788f6a158ffe4a4a8870d8c4.exe	28
PID 2292 wrote to memory of 3056	2292	aebcd4f236369977e1c6fd9307eca7beff9f405d788f6a158ffe4a4a8870d8c4.exe	28
PID 2292 wrote to memory of 3056	2292	aebcd4f236369977e1c6fd9307eca7beff9f405d788f6a158ffe4a4a8870d8c4.exe	28
PID 2292 wrote to memory of 3056	2292	aebcd4f236369977e1c6fd9307eca7beff9f405d788f6a158ffe4a4a8870d8c4.exe	28
PID 3056 wrote to memory of 2596	3056	cmd.exe	30
PID 3056 wrote to memory of 2596	3056	cmd.exe	30
PID 3056 wrote to memory of 2596	3056	cmd.exe	30
PID 3056 wrote to memory of 2596	3056	cmd.exe	30

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

C:\Windows\SysWOW64\JVTFTM.exe.bat

Filesize
76B

MD5
95b48c7e286a05129552b7cf1c595843

SHA1
17c1fdfddac04d8e5b8d9d30a9b49c00629bb7c9

SHA256
5ace22d814c908a154c5a07e77a1da64af02e10e49e461bb0272f26f4e10878b

SHA512
44079f8a3df98b4123f14121179dec3c6d81e406d84a748acad484fe0fe67bfeeb51055323d66cb4182b54f12924acb6f6ae66f72c2fdcbb9ed9bbde182da2b8

Download Submit
\Windows\SysWOW64\JVTFTM.exe

Filesize
320KB

MD5
f326464c0cc1361ffb86495630491374

SHA1
734bfc1c132b7d32d68d2c4b9596de1443ca3946

SHA256
5d92d0dd30b42120f92726599360407685f504ff1c1503224a2f439998ffc832

SHA512
eb1e5ff777e64a65e44c034ad0dc510254b74c41bc7a2f51934e7738a4c9ee1b09526b098bc0edb8d10295fdd6f65ae0c7da51900040bcb72ed4d1692c67d23c

Download Submit
memory/2292-0-0x0000000000400000-0x0000000000438000-memory.dmp

Filesize
224KB

Download
memory/2292-12-0x0000000000400000-0x0000000000438000-memory.dmp

Filesize
224KB

Download
memory/2596-19-0x0000000000400000-0x0000000000438000-memory.dmp

Filesize
224KB

Download
memory/2596-20-0x0000000000400000-0x0000000000438000-memory.dmp

Filesize
224KB

Download
memory/3056-18-0x0000000000320000-0x0000000000358000-memory.dmp

Filesize
224KB

Download