ef268c8b68b03063c8b802c381d1098f954cc6586eb2f66013bbf3ccec687abf

Analysis

max time kernel
118s
max time network
119s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
17-05-2024 14:49

Target

e363be771314616a653cba4975637a4c.exe
Size

320KB
MD5

e363be771314616a653cba4975637a4c
SHA1

aa14377449a6b83e30fa21a1208afdcbc5b5bfd0
SHA256

ef268c8b68b03063c8b802c381d1098f954cc6586eb2f66013bbf3ccec687abf
SHA512

440bb8192c3ba56ab740103a5e2f97b543bfe451626a59202529a782fb81abac165d421220a97ceaa58007207b7cb204c1d0261e6cf9d2226dce49dd18914609
SSDEEP

3072:tsFh2/HIdPOOjx/BM6C9yTqBnKp4ucfbLAbMYj4NfhANhirVkh34pLthEjQT68TU:tygOlq9y/FCbsbP2AkEjWbjcSbcY+CA

Score

7^/10

Executes dropped EXE 1 IoCs

pid	Process
3004	ZNOBQGK.exe

Loads dropped DLL 2 IoCs

pid	Process
2736	cmd.exe
2736	cmd.exe

Drops file in System32 directory 3 IoCs

description	ioc	Process
File created	C:\windows\SysWOW64\ZNOBQGK.exe	e363be771314616a653cba4975637a4c.exe
File opened for modification	C:\windows\SysWOW64\ZNOBQGK.exe	e363be771314616a653cba4975637a4c.exe
File created	C:\windows\SysWOW64\ZNOBQGK.exe.bat	e363be771314616a653cba4975637a4c.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
2884	e363be771314616a653cba4975637a4c.exe
3004	ZNOBQGK.exe

Suspicious use of SetWindowsHookEx 4 IoCs

Suspicious use of WriteProcessMemory 8 IoCs

description	pid	Process	procid_target
PID 2884 wrote to memory of 2736	2884	e363be771314616a653cba4975637a4c.exe	28
PID 2884 wrote to memory of 2736	2884	e363be771314616a653cba4975637a4c.exe	28
PID 2884 wrote to memory of 2736	2884	e363be771314616a653cba4975637a4c.exe	28
PID 2884 wrote to memory of 2736	2884	e363be771314616a653cba4975637a4c.exe	28
PID 2736 wrote to memory of 3004	2736	cmd.exe	30
PID 2736 wrote to memory of 3004	2736	cmd.exe	30
PID 2736 wrote to memory of 3004	2736	cmd.exe	30
PID 2736 wrote to memory of 3004	2736	cmd.exe	30

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

C:\Windows\SysWOW64\ZNOBQGK.exe.bat

Filesize
78B

MD5
d2014b165d456c802fffcf78bbe6e651

SHA1
a3197f741cfc73f934fca38bb5769f4123ccaca6

SHA256
8cc3fe4697b3413459fd739f19bb8234b328c7d53679f3fea6bd5021fe63709e

SHA512
c3c895c02f189d5105802e6a883b39b027768af7d16b10ec87fad1e1662bca48e47ac02804ffe93580e9e5899b7e7f40effbe5fd2fdfb0882594f7baa8373bb8

Download Submit
\Windows\SysWOW64\ZNOBQGK.exe

Filesize
320KB

MD5
b25c842af429a3244f957de8c21d0556

SHA1
3de6c521751be96e302d46efd270a014fc0683a8

SHA256
1236a0cd7893b816ef363aca020213071409ec6ef2a1169e4ef0226e8e8aaaab

SHA512
7148fc0cacb9132cddd9f9753f28d53efeebc6ef90a4ccb91d7163ea717428bb3facd6e5e39435c26e32d9b1224c376b7bf4eceaaaa6ae25cc4aac266568b296

Download Submit
memory/2736-18-0x0000000000150000-0x0000000000188000-memory.dmp

Filesize
224KB

Download
memory/2884-0-0x0000000000400000-0x0000000000438000-memory.dmp

Filesize
224KB

Download
memory/2884-12-0x0000000000400000-0x0000000000438000-memory.dmp

Filesize
224KB

Download
memory/3004-19-0x0000000000400000-0x0000000000438000-memory.dmp

Filesize
224KB

Download
memory/3004-20-0x0000000000400000-0x0000000000438000-memory.dmp

Filesize
224KB

Download