421f4440f58626dee0b210e97b0fea1c3f65240694e55112f27cb8d94d96523a

Analysis

max time kernel
119s
max time network
123s
platform
windows7_x64
resource
win7-20240319-en
resource tags

arch:x64arch:x86image:win7-20240319-enlocale:en-usos:windows7-x64system
submitted
09-04-2024 20:01

Target

902c65798181b47545854c7f93b2fbef.exe
Size

208KB
MD5

902c65798181b47545854c7f93b2fbef
SHA1

817c3c2345c324b05cc7b492dd1d54d68871fb87
SHA256

421f4440f58626dee0b210e97b0fea1c3f65240694e55112f27cb8d94d96523a
SHA512

f43c5a5dbf342d03f95288a77a39d67535f43b342283657dee9910d5290667046d03e4e085dac58abc5a09c080cac3305f59085d01ba5d371d2a48e363dc1df0
SSDEEP

6144:s8504w4zGMjtHNq2ARO6kERKci+YTUkdBEtWk/Vc1e7VQEj:Ij4iMxHNpAPk31+Y4kdBEtZVQ

Score

7^/10

Executes dropped EXE 1 IoCs

pid	Process
2040	EWSOMBM.exe

Loads dropped DLL 2 IoCs

pid	Process
3060	cmd.exe
3060	cmd.exe

Drops file in Windows directory 3 IoCs

description	ioc	Process
File created	C:\windows\system\EWSOMBM.exe	902c65798181b47545854c7f93b2fbef.exe
File opened for modification	C:\windows\system\EWSOMBM.exe	902c65798181b47545854c7f93b2fbef.exe
File created	C:\windows\system\EWSOMBM.exe.bat	902c65798181b47545854c7f93b2fbef.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
2380	902c65798181b47545854c7f93b2fbef.exe
2040	EWSOMBM.exe

Suspicious use of SetWindowsHookEx 4 IoCs

Suspicious use of WriteProcessMemory 8 IoCs

description	pid	Process	procid_target
PID 2380 wrote to memory of 3060	2380	902c65798181b47545854c7f93b2fbef.exe	28
PID 2380 wrote to memory of 3060	2380	902c65798181b47545854c7f93b2fbef.exe	28
PID 2380 wrote to memory of 3060	2380	902c65798181b47545854c7f93b2fbef.exe	28
PID 2380 wrote to memory of 3060	2380	902c65798181b47545854c7f93b2fbef.exe	28
PID 3060 wrote to memory of 2040	3060	cmd.exe	30
PID 3060 wrote to memory of 2040	3060	cmd.exe	30
PID 3060 wrote to memory of 2040	3060	cmd.exe	30
PID 3060 wrote to memory of 2040	3060	cmd.exe	30

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

C:\Windows\system\EWSOMBM.exe.bat

Filesize
74B

MD5
c65878ff11ec4d682e1a6d5500d4f2c2

SHA1
bdf97bac9f54a90a06331d93e6902162ff51c2a4

SHA256
6a055c801495ad98fe01c6bd24e5a07875cf81531cefafb848d2d486b05cdf31

SHA512
87eb03a33dcabd057016342dac09a4bd39264670bf6a5eaf3be5eabd4e7bf9055a639fc6f72fdad8c2dbaf5beee6da58307394c71f7fd78e648c6a2ece4227aa

Download Submit
\Windows\system\EWSOMBM.exe

Filesize
208KB

MD5
3bc711ddb36b248a296b7858d8044c20

SHA1
9b7fc35cb908c80df0ba5d6c5644f16754c83f34

SHA256
6edb8c1d1d9e46ce3880da6ddb070668b6d847ae83bd6192596fc0bb4768305b

SHA512
00810cbcaefc5fb3ad2c1c2b66370eaaa22e99fc124a4811a9145ad8a222c76188df1f70cd9d9700986f414ea730ad906e790f4e4034f8f10c7ac9119def025b

Download Submit
memory/2040-20-0x0000000000400000-0x0000000000438000-memory.dmp

Filesize
224KB

Download
memory/2040-21-0x0000000000400000-0x0000000000438000-memory.dmp

Filesize
224KB

Download
memory/2380-0-0x0000000000400000-0x0000000000438000-memory.dmp

Filesize
224KB

Download
memory/2380-12-0x0000000000400000-0x0000000000438000-memory.dmp

Filesize
224KB

Download
memory/3060-18-0x0000000000270000-0x00000000002A8000-memory.dmp

Filesize
224KB

Download
memory/3060-19-0x0000000000270000-0x00000000002A8000-memory.dmp

Filesize
224KB

Download