6916afd799307f0426724542f38f464ed508c2829804dcbb39921f552b3f506c

Analysis

max time kernel
118s
max time network
119s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
08/05/2024, 14:58

Target
bin/download/MiniTPFw.exe
Size 58KB
Sample240508-scksxaaa7w
SHA256 f02fa7ddab2593492b9b68e3f485e59eb755380a9235f6269705f6d219dff100
MD5 58bb62e88687791ad2ea5d8d6e3fe18b
SHA1 0ffb029064741d10c9cf3f629202aa97167883de
SHA512 cd36b28f87be9cf718f0c44bf7c500d53186edc08889bcfa5222041ff31c5cbee509b186004480efbd99c36b2233182ae0969447f4051510e1771a73ed209da5
SSDEEP 768:BSODywYihzSrVPdQsNruuGYOLO3NNkFlBi1jSZIfjeGdJARt03juFGu:BSKywYDdQsQuG5L27Ui1SPRt0qf
MD5 SHA1 SHA512 SSDEEP

Score

3^/10

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2940 wrote to memory of 3040	2940	MiniTPFw.exe	29
PID 2940 wrote to memory of 3040	2940	MiniTPFw.exe	29
PID 2940 wrote to memory of 3040	2940	MiniTPFw.exe	29
PID 2940 wrote to memory of 3040	2940	MiniTPFw.exe	29

C:\Users\Admin\AppData\Local\Temp\bin\download\MiniTPFw.exe
"C:\Users\Admin\AppData\Local\Temp\bin\download\MiniTPFw.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2940
- C:\Users\Admin\AppData\Local\Temp\bin\download\ThunderFW.exe
  "C:\Users\Admin\AppData\Local\Temp\bin\download\ThunderFW.exe" MiniThunderPlatform2024-05-0814:58:57 "C:\Users\Admin\AppData\Local\Temp\bin\download\MiniThunderPlatform.exe"
  2⤵
  PID:3040

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact