fb6a37d9411d1876e0fd2193f90f43f3be3213a035e4f9eb851134dae4c2b7de

Analysis

max time kernel
144s
max time network
161s
platform
windows11-21h2_x64
resource
win11-20240412-en
resource tags

arch:x64arch:x86image:win11-20240412-enlocale:en-usos:windows11-21h2-x64system
submitted
18-04-2024 01:14

Target

2.exe
Size

524KB
MD5

38a1afe9e731888235eb40eccb3953c2
SHA1

aac813693e7f88455c76af2d84962f6ee4bb06c5
SHA256

fb6a37d9411d1876e0fd2193f90f43f3be3213a035e4f9eb851134dae4c2b7de
SHA512

8085296a33eef7e1c607b82584de1c5a6b330c38eaf013d02a6eeefa97bc3f4a664a738eaf8f63c3636a31249c420e20243895414dafe5ad1f9ab45c994eec91
SSDEEP

12288:IHxRHEKFBwR1R46A9jmP/uhu/yMS08CkntxYR:IjkKFYKfmP/UDMS08Ckn3

Score

3^/10

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious use of SetWindowsHookEx 3 IoCs

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4416 wrote to memory of 1212	4416	2.exe	81
PID 4416 wrote to memory of 1212	4416	2.exe	81
PID 4416 wrote to memory of 1212	4416	2.exe	81

C:\Users\Admin\AppData\Local\Temp\2.exe
"C:\Users\Admin\AppData\Local\Temp\2.exe"
1⤵
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4416
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c C:\Users\Admin\AppData\Local\Temp\
  2⤵
  PID:1212

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact