cdb4690f2f00fef918fc2f175c19045f0fb346a499e59f0b8ec2a6f64b03f52e

Resubmissions

23/04/2024, 14:27

23/04/2024, 14:24

max time kernel
1801s
max time network
1696s
platform
windows10-2004_x64
resource
win10v2004-20240226-es
resource tags

arch:x64arch:x86image:win10v2004-20240226-eslocale:es-esos:windows10-2004-x64systemwindows
submitted
23/04/2024, 14:27

Target

Toolbox OptimizerV1.0.exe
Size

455KB
MD5

0569b38220c2d30697ffbc398308f213
SHA1

d01b93f9b2c6c6f8269e47134ee2a8639cdb29af
SHA256

cdb4690f2f00fef918fc2f175c19045f0fb346a499e59f0b8ec2a6f64b03f52e
SHA512

380ad86a1f83d2f9cd2461f666fc38245c8a0dea1a6bcdf5ad5b161fd72d092826cb5fb33bb278cec09866e9a8dfa95b054fa1d35719e52665e85cfbdfe9374f
SSDEEP

3072:Q7DhdC6kzWypvaQ0FxyNTBf87pzseuW8Rz7m2klts+CDiVsgw7b6:QBlkZvaF4NTBE7LUKwzgw7b6

Score

3^/10

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
1536	msedge.exe
1536	msedge.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 3932 wrote to memory of 3324	3932	Toolbox OptimizerV1.0.exe	96
PID 3932 wrote to memory of 3324	3932	Toolbox OptimizerV1.0.exe	96
PID 3324 wrote to memory of 1048	3324	cmd.exe	97
PID 3324 wrote to memory of 1048	3324	cmd.exe	97

C:\Users\Admin\AppData\Local\Temp\Toolbox OptimizerV1.0.exe
"C:\Users\Admin\AppData\Local\Temp\Toolbox OptimizerV1.0.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:3932
- C:\Windows\system32\cmd.exe
  "C:\Windows\sysnative\cmd" /c "C:\Users\Admin\AppData\Local\Temp\BA33.tmp\BAD0.tmp\BAE1.bat "C:\Users\Admin\AppData\Local\Temp\Toolbox OptimizerV1.0.exe""
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:3324
- - C:\Windows\system32\mode.com
    mode con:cols=128 lines=40
    3⤵
    PID:1048

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --no-appcompat-clear --gpu-preferences=WAAAAAAAAADoAAAMAAAAAAAAAAAAAAAAAABgAAAAAAA4AAAAAAAAAAAAAABEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGAAAAAAAAAAYAAAAAAAAAAgAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --mojo-platform-channel-handle=6292 --field-trial-handle=1984,i,6250324430674571549,669234090731242346,262144 --variations-seed-version /prefetch:8
1⤵
- Suspicious behavior: EnumeratesProcesses
PID:1536

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=es --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=6068 --field-trial-handle=1984,i,6250324430674571549,669234090731242346,262144 --variations-seed-version /prefetch:8
1⤵
PID:932

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=es --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=5196 --field-trial-handle=1984,i,6250324430674571549,669234090731242346,262144 --variations-seed-version /prefetch:8
1⤵
PID:4584

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

C:\Users\Admin\AppData\Local\Temp\BA33.tmp\BAD0.tmp\BAE1.bat

Filesize
87KB

MD5
3512b263fbfaa854e3dffc248d511dd4

SHA1
db752939ffb2659bd32b9c4b91c2173a6a505082

SHA256
7dc4222c41085904ae65a81d758911fd0b1ef3f0578368fc5d17c3e0240d2450

SHA512
8f54d744bf9e1368352049f3ec9aa5422494c66d7ea1e9893b3d0daecc773810148076dcfe1160b2f36ee93aa5b18ff013992b6e3abd1c8517429ff76b54cba2

Download Submit