850cffb326094806664edffefbf212902b327596fd3118d55344e2162a9bdde4

Analysis

max time kernel
150s
max time network
150s
platform
windows7_x64
resource
win7-20240508-en
resource tags

arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system
submitted
22-05-2024 23:52

Target

850cffb326094806664edffefbf212902b327596fd3118d55344e2162a9bdde4.exe
Size

5KB
MD5

6b24634f1575fff4d4100e3413d6db5a
SHA1

40b124a79ed7f8c9c560b9ae36eb16f6d7584b69
SHA256

850cffb326094806664edffefbf212902b327596fd3118d55344e2162a9bdde4
SHA512

6b2e1c8601bda1d4d544bff04f898ac87d8f63c12c6e420a37bb95f58fea47b1362e3b16a062913a783a94c32701f6508a8043a1abeec6eb3993ad4b5cce1d7c
SSDEEP

48:6hef2FDL0CTctgGWvLHmCyY/ZJi8d/1/UzEVnQBG/RACalGUV2CS7DD:QXR9YtevLGa/3ldd/wAnQWRRUV2CqD

Score

7^/10

Deletes itself 1 IoCs

Processes:

kdeohw.exe

pid process

2592 kdeohw.exe
Executes dropped EXE 1 IoCs

Processes:

kdeohw.exe

pid process

2592 kdeohw.exe

pid	process
2592	kdeohw.exe

pid	process
2592	kdeohw.exe

Loads dropped DLL 2 IoCs

Processes:

850cffb326094806664edffefbf212902b327596fd3118d55344e2162a9bdde4.exe

pid	process
1844	850cffb326094806664edffefbf212902b327596fd3118d55344e2162a9bdde4.exe
1844	850cffb326094806664edffefbf212902b327596fd3118d55344e2162a9bdde4.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious use of WriteProcessMemory 4 IoCs

Processes:

850cffb326094806664edffefbf212902b327596fd3118d55344e2162a9bdde4.exe

description	pid	process	target process
PID 1844 wrote to memory of 2592	1844	850cffb326094806664edffefbf212902b327596fd3118d55344e2162a9bdde4.exe	kdeohw.exe
PID 1844 wrote to memory of 2592	1844	850cffb326094806664edffefbf212902b327596fd3118d55344e2162a9bdde4.exe	kdeohw.exe
PID 1844 wrote to memory of 2592	1844	850cffb326094806664edffefbf212902b327596fd3118d55344e2162a9bdde4.exe	kdeohw.exe
PID 1844 wrote to memory of 2592	1844	850cffb326094806664edffefbf212902b327596fd3118d55344e2162a9bdde4.exe	kdeohw.exe

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

\Users\Admin\AppData\Local\Temp\kdeohw.exe

Filesize
5KB

MD5
23321557d24d6d62de0fb78af85bab2b

SHA1
7295709d305a2e8cd17084569a9d957cb29fa923

SHA256
b01b9677baac30133a2e08aa7b104ff8e3397ef9586b6204def8c3f90067f6da

SHA512
ae7ee2f4f1f36b2c905ec7600e41e00227c23e6d9798bd9c869637447ad6d6bb9bae98a6b70ee921d6117bdc8549db05e089c66b14fa1ff8830c087c2b50dc89

Download Submit