3b880870e629dc5d230309fa7a79e25193d199f1ff8100a8cb45f3a7113524da

Analysis

max time kernel
139s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20240419-en
resource tags

arch:x64arch:x86image:win10v2004-20240419-enlocale:en-usos:windows10-2004-x64system
submitted
02/05/2024, 20:43

Target
3b880870e629dc5d230309fa7a79e25193d199f1ff8100a8cb45f3a7113524da.exe
Size 1.5MB
Sample240502-zhj7wsfb8v
SHA256 3b880870e629dc5d230309fa7a79e25193d199f1ff8100a8cb45f3a7113524da
MD5 1fca0f9f953b6ef460a928fb2501b393
SHA1 39024478ea8e4eb30685fc8f8a43baf4f36c2f38
SHA512 bd2491112838f7e7d3a1c0b369db1adec1f7a88c5f968618e8ebfbde49756bdaa920510b4c676a877454a4ee753ad73022eeceb5a82adc9069f4ff8422f8e461
SSDEEP 24576:/RZeiSc0ciFmCQYJ7iFfnZu8/cIbXEyGobPf4cgo9e5PWLfmP/UDMS08Ckn3:JZehc4mTYJ78V9gyBn4cVLfmP/SA8N
MD5 SHA1 SHA512 SSDEEP

Score

3^/10

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious use of SetWindowsHookEx 3 IoCs

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4108 wrote to memory of 1208	4108	3b880870e629dc5d230309fa7a79e25193d199f1ff8100a8cb45f3a7113524da.exe	84
PID 4108 wrote to memory of 1208	4108	3b880870e629dc5d230309fa7a79e25193d199f1ff8100a8cb45f3a7113524da.exe	84
PID 4108 wrote to memory of 1208	4108	3b880870e629dc5d230309fa7a79e25193d199f1ff8100a8cb45f3a7113524da.exe	84

C:\Users\Admin\AppData\Local\Temp\3b880870e629dc5d230309fa7a79e25193d199f1ff8100a8cb45f3a7113524da.exe
"C:\Users\Admin\AppData\Local\Temp\3b880870e629dc5d230309fa7a79e25193d199f1ff8100a8cb45f3a7113524da.exe"
1⤵
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4108
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c C:\Users\Admin\AppData\Local\Temp\
  2⤵
  PID:1208

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact