58cb93ebbf4fb0ccfa194ba814b45eb4413d9122a911806ca799494a7746b971

Analysis

max time kernel
117s
max time network
118s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
11-05-2024 11:26

Target

$_3_.exe
Size

1.8MB
MD5

77bfacca17ee1d89833b57f3a746d9a0
SHA1

aa9490c913489c5eafd02f67f875efcb56d23036
SHA256

38571b0965110d07c6fbf4813ab628d4017cf52c681c457fb3f184b644fb0b52
SHA512

21ecc2fce94a58cd39127964730b01722b9dafa20d3af65b023fe83188c08211ba1324849513ffc10b6a359737f98c4d06770dc1954f8880daff938a06581e6f
SSDEEP

49152:/SNY8H0ZGF5j51XdQTPRPgojx1NslvUOl/WkMWAH:oY00Z8F1XdUL

Score

3^/10

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Runs ping.exe 1 TTPs 1 IoCs

Remote System Discovery

pid	Process
656	PING.EXE

Suspicious behavior: EnumeratesProcesses 1 IoCs

pid	Process
1996	$_3_.exe

Suspicious use of SetWindowsHookEx 3 IoCs

Suspicious use of WriteProcessMemory 8 IoCs

description	pid	Process	procid_target
PID 1996 wrote to memory of 1424	1996	$_3_.exe	30
PID 1996 wrote to memory of 1424	1996	$_3_.exe	30
PID 1996 wrote to memory of 1424	1996	$_3_.exe	30
PID 1996 wrote to memory of 1424	1996	$_3_.exe	30
PID 1424 wrote to memory of 656	1424	cmd.exe	32
PID 1424 wrote to memory of 656	1424	cmd.exe	32
PID 1424 wrote to memory of 656	1424	cmd.exe	32
PID 1424 wrote to memory of 656	1424	cmd.exe	32

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Remote System Discovery

System Information Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

C:\Users\Admin\AppData\Local\Temp\9105.bat

Filesize
214B

MD5
739fcc7ba42b209fe44bea47e7a8c48f

SHA1
bc7a448a7c018133edcf012bc94301623eb42c5b

SHA256
69017cdbbe68396f45e41d211b22d800cc1afc0eadbd3440873038585020315c

SHA512
2b2b130798b0f4e534626b9fb5deaa10bb1930e6700ac0ba7cf151c1bf3239039a7032ea67ceed86a4a4dbe981064c42a8e0f88fe8361e27002dd8ceb0ea767a

Download Submit
C:\Users\Admin\AppData\Local\Temp\F823EC9DBADC4EEA89C9882D159AD63A\F823EC9DBADC4EEA89C9882D159AD63A_LogFile.txt

Filesize
9KB

MD5
b2d5471a204b030aa8901632f1d730ce

SHA1
32a5de66399b46881da902235149f65deb4ea4e4

SHA256
099c12401d78c3b716bcd0b41b0d30cb271c8f9c7c887f77395fb05ffa7aa8d7

SHA512
4267fcd100d02b5cbdd98399bd809b4089b5feaa771ee0dbc85db3753d1426890eebe6805a507519996fd540532ae8871969b40e59776554df463d26575325b7

Download Submit
C:\Users\Admin\AppData\Local\Temp\F823EC9DBADC4EEA89C9882D159AD63A\F823EC~1.TXT

Filesize
109KB

MD5
7894f263f780f45d3aa15f9fad7e28f5

SHA1
29c114b507363b1f68240992c40b7bbdb802d55c

SHA256
4191840712d6738b5e4b6c1cdf835c294a6c60f8efed1996257dbfc257decead

SHA512
8b962d22ae8fde2e0e390edc8f54b5001b50c230794528839fb6eb722b4e46cefc9ee8e524658bc59cb4140052ba040ab1d5587edda74d5255c42fe8401b89a8

Download Submit
memory/1996-61-0x00000000003C0000-0x00000000003C1000-memory.dmp

Filesize
4KB

Download
memory/1996-185-0x00000000003C0000-0x00000000003C1000-memory.dmp

Filesize
4KB

Download