5452dc39044f0d4fc32236dda5c4ce986ae5aa33e6e1b653b3ed53fdf1ca745a

Analysis

max time kernel
144s
max time network
147s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
17-04-2024 01:24

Target

5452dc39044f0d4fc32236dda5c4ce986ae5aa33e6e1b653b3ed53fdf1ca745a.exe
Size

1.0MB
MD5

588fe99f2631db84a27bbfceca342f8c
SHA1

84349b654c2f549d85dff6c3a548c7e11f79a5e3
SHA256

5452dc39044f0d4fc32236dda5c4ce986ae5aa33e6e1b653b3ed53fdf1ca745a
SHA512

d00d71d1d1bb8699727914a39190414f332c5be706f66b39ad1b1b8044c2ee7aec17511d784c864660c4c5230d51f69fc577b79ddc37d4c453a66f0bb25d9dfd
SSDEEP

12288:Me/cwY1icfinL+r3FI4PpJEtpnxnI+UejPFnOVy/:/YTr1IDtpnv9P

Score

7^/10

Executes dropped EXE 1 IoCs

Processes:

6JEJ8Q4R.exe

pid process

2904 6JEJ8Q4R.exe

pid	process
2904	6JEJ8Q4R.exe

Loads dropped DLL 2 IoCs

Processes:

5452dc39044f0d4fc32236dda5c4ce986ae5aa33e6e1b653b3ed53fdf1ca745a.exe

pid	process
2988	5452dc39044f0d4fc32236dda5c4ce986ae5aa33e6e1b653b3ed53fdf1ca745a.exe
2988	5452dc39044f0d4fc32236dda5c4ce986ae5aa33e6e1b653b3ed53fdf1ca745a.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious use of WriteProcessMemory 4 IoCs

Processes:

5452dc39044f0d4fc32236dda5c4ce986ae5aa33e6e1b653b3ed53fdf1ca745a.exe

description	pid	process	target process
PID 2988 wrote to memory of 2904	2988	5452dc39044f0d4fc32236dda5c4ce986ae5aa33e6e1b653b3ed53fdf1ca745a.exe	6JEJ8Q4R.exe
PID 2988 wrote to memory of 2904	2988	5452dc39044f0d4fc32236dda5c4ce986ae5aa33e6e1b653b3ed53fdf1ca745a.exe	6JEJ8Q4R.exe
PID 2988 wrote to memory of 2904	2988	5452dc39044f0d4fc32236dda5c4ce986ae5aa33e6e1b653b3ed53fdf1ca745a.exe	6JEJ8Q4R.exe
PID 2988 wrote to memory of 2904	2988	5452dc39044f0d4fc32236dda5c4ce986ae5aa33e6e1b653b3ed53fdf1ca745a.exe	6JEJ8Q4R.exe

C:\Users\Admin\AppData\Local\Temp\WPDNSE\6JEJ8Q4R.exe
"C:\Users\Admin\AppData\Local\Temp\WPDNSE\6JEJ8Q4R.exe"
2⤵
- Executes dropped EXE
PID:2904

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Resource Development

Reconnaissance

\Users\Admin\AppData\Local\Temp\WPDNSE\6JEJ8Q4R.exe
Filesize
159KB

MD5
3f2f75660ddca3660f254222ec2e54d9

SHA1
9e5710c00fc26b4d26d95c644040f56b652708b0

SHA256
ffe8a2116f63f9d5cdb408f3d1e8f476ea595b7323bc95808e33b45084f2e14f

SHA512
fee657800f455a2026a5ba4fb7e424bf52e77d1922c91fadd2f5a4284269eaa93c860065da13a439ea6c79ea855ecc58b99b9a293b6e64e91cc2dffd5ef92bbd

Download Submit
memory/2904-12-0x0000000000400000-0x000000000043D000-memory.dmp

Filesize
244KB

Download
memory/2988-0-0x00000000012B0000-0x0000000001326000-memory.dmp

Filesize
472KB

Download
memory/2988-1-0x0000000074A60000-0x000000007514E000-memory.dmp

Filesize
6.9MB

Download
memory/2988-13-0x0000000000AD0000-0x0000000000B0D000-memory.dmp

Filesize
244KB

Download
memory/2988-6-0x0000000000AD0000-0x0000000000B0D000-memory.dmp

Filesize
244KB

Download
memory/2988-14-0x0000000074A60000-0x000000007514E000-memory.dmp

Filesize
6.9MB

Download