7d3ff41401c78239e784e4c11ef0c74d66a4e40afcb8dcbec2fc2284ae2a469e

Analysis

max time kernel
145s
max time network
148s
platform
windows10-2004_x64
resource
win10v2004-20240426-en
resource tags

arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system
submitted
22-05-2024 23:32

Target

7d3ff41401c78239e784e4c11ef0c74d66a4e40afcb8dcbec2fc2284ae2a469e.exe
Size

495KB
MD5

a5358ad15678d24fe88bb1fe32d29ae3
SHA1

86f0639010c601118aeea1767d48d865f4b6bb8e
SHA256

7d3ff41401c78239e784e4c11ef0c74d66a4e40afcb8dcbec2fc2284ae2a469e
SHA512

ce06f31ab63a46b1fa9f57b213f034222a7f53a1e97a8cb24bec6c2829264a3bf368a9c86d2650ddc6bc1c5a74229c2dcb0c4239360f60cc2bca18ece290f5a5
SSDEEP

12288:NyAfDcgcTQhgpZBDtoRAG01LqTl2mZoikM:vDVBADt1ZKlXEM

Score

7^/10

Executes dropped EXE 1 IoCs

Processes:

EXE4AA5.tmp

pid process

3040 EXE4AA5.tmp
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082
Suspicious use of SetWindowsHookEx 2 IoCs

Processes:

EXE4AA5.tmp

pid process

3040 EXE4AA5.tmp
3040 EXE4AA5.tmp

pid	process
3040	EXE4AA5.tmp

pid	process
3040	EXE4AA5.tmp
3040	EXE4AA5.tmp

Suspicious use of WriteProcessMemory 5 IoCs

Processes:

7d3ff41401c78239e784e4c11ef0c74d66a4e40afcb8dcbec2fc2284ae2a469e.exeEXE4AA5.tmp

description	pid	process	target process
PID 4284 wrote to memory of 3040	4284	7d3ff41401c78239e784e4c11ef0c74d66a4e40afcb8dcbec2fc2284ae2a469e.exe	EXE4AA5.tmp
PID 4284 wrote to memory of 3040	4284	7d3ff41401c78239e784e4c11ef0c74d66a4e40afcb8dcbec2fc2284ae2a469e.exe	EXE4AA5.tmp
PID 4284 wrote to memory of 3040	4284	7d3ff41401c78239e784e4c11ef0c74d66a4e40afcb8dcbec2fc2284ae2a469e.exe	EXE4AA5.tmp
PID 3040 wrote to memory of 4812	3040	EXE4AA5.tmp	splwow64.exe
PID 3040 wrote to memory of 4812	3040	EXE4AA5.tmp	splwow64.exe

C:\Users\Admin\AppData\Local\Temp\7d3ff41401c78239e784e4c11ef0c74d66a4e40afcb8dcbec2fc2284ae2a469e.exe
"C:\Users\Admin\AppData\Local\Temp\7d3ff41401c78239e784e4c11ef0c74d66a4e40afcb8dcbec2fc2284ae2a469e.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:4284

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k PrintWorkflow -s PrintWorkflowUserSvc
1⤵
PID:3512

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Resource Development

Reconnaissance

C:\Users\Admin\AppData\Local\Temp\EXE4AA5.tmp
Filesize
968KB

MD5
0f619e7352920d8d21926f2b715e0794

SHA1
cdd75d72647b1c75477c069b51b5f8ab5dc63e50

SHA256
e6090962c2504441c1cd5f6ee75dd5ffbddc38062f02807f0d44176d8f464381

SHA512
380592a1382f40d80839efea429619470b09fc0c0aad8666c6392d8dbd112f5e8719538fc93044454f4ce67375aaae8da59e09563b167ff8adf34240be684dae

Download Submit
C:\Users\Admin\AppData\Local\Temp\OFM4AB6.tmp
Filesize
48KB

MD5
f3f70f725ad7b80a417ca119b8ba7bed

SHA1
0e887b51b3bdbbf400b14da9255d416ca4ba80fc

SHA256
97bd8c349d25e6856b56550abad3ff3b11ec2f9384dfc1dd8a1d1f3e500d6af2

SHA512
a24758e8e7a8e7aabfce0f63e55bd10bd6af405fce08159d18c9f656f4079bdf246accd64ef25e407b90d3428323bdb85f40c3ba4ad664521fd659d719428412

Download Submit