5c95e51e73f58a8d0fd768c1b3921e313fda809a21f8649fd7c8f842012a5381

Analysis

max time kernel
120s
max time network
124s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
26-04-2024 20:32

Target

PAYMENT FROM OUR SBI BANK.exe
Size

536KB
MD5

d554b4c1aa278eeaf10def8ea5973cd6
SHA1

f1056fb198e27b567d46c3fe7b2d355c925988fd
SHA256

b2db0dad3f1acb31633bc8d135453b5141d75ce89212a303a9148a40f60eb917
SHA512

00d9d6a1ff4cfd43a3e11e4b81d47a559eef3e03011c24a160e614064cd42a2a87c9f7da586d0cc33d8ec3db025050468aea708865b80d7aaa0250dc81d6e62d
SSDEEP

12288:0uv+XyDHRqUaW46A9jmP/uhu/yMS08CkntxYRS:rv0wHROfmP/UDMS08Ckn3P

Score

3^/10

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082
Suspicious use of SetWindowsHookEx 3 IoCs

Processes:

PAYMENT FROM OUR SBI BANK.exe

pid process

2888 PAYMENT FROM OUR SBI BANK.exe
2888 PAYMENT FROM OUR SBI BANK.exe
2888 PAYMENT FROM OUR SBI BANK.exe

Suspicious use of WriteProcessMemory 4 IoCs

Processes:

PAYMENT FROM OUR SBI BANK.exe

description	pid	process	target process
PID 2888 wrote to memory of 2996	2888	PAYMENT FROM OUR SBI BANK.exe	cmd.exe
PID 2888 wrote to memory of 2996	2888	PAYMENT FROM OUR SBI BANK.exe	cmd.exe
PID 2888 wrote to memory of 2996	2888	PAYMENT FROM OUR SBI BANK.exe	cmd.exe
PID 2888 wrote to memory of 2996	2888	PAYMENT FROM OUR SBI BANK.exe	cmd.exe

C:\Windows\SysWOW64\cmd.exe
cmd.exe /c C:\Users\Admin\AppData\Local\Temp\
2⤵
PID:2996

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Resource Development

Reconnaissance