aa8b2bdf7aea5d39df6921fcff7da3c813ee4c52b0773d4e82089e1f1b724d2d

Analysis

max time kernel
133s
max time network
143s
platform
windows7_x64
resource
win7-20240508-en
resource tags

arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system
submitted
22-05-2024 02:19

Target

aa8b2bdf7aea5d39df6921fcff7da3c813ee4c52b0773d4e82089e1f1b724d2d.exe
Size

2.8MB
MD5

706b45a0453ecd341865fe74327137e4
SHA1

7afd7beed65ba72e18268944e17af0ba1e724039
SHA256

aa8b2bdf7aea5d39df6921fcff7da3c813ee4c52b0773d4e82089e1f1b724d2d
SHA512

9624c35f6b979af4f8b4d49af55a62893010c6eb9a789cc8785d67647ed27a6e02e354274697c800c9dd64cd86c658fdd02ddc804d4625b02263f1134feb3a83
SSDEEP

49152:xA86TbY9dfVUk0SJj/E7K2cWLcd6DX5CQDKEGwiZ0TCdcisy1Nw:xA8Gqda+2cmQ4IQDKEy9w

Score

7^/10

Executes dropped EXE 1 IoCs

Processes:

Un_A.exe

pid process

2536 Un_A.exe
Loads dropped DLL 2 IoCs

Processes:

aa8b2bdf7aea5d39df6921fcff7da3c813ee4c52b0773d4e82089e1f1b724d2d.exeUn_A.exe

pid process

2928 aa8b2bdf7aea5d39df6921fcff7da3c813ee4c52b0773d4e82089e1f1b724d2d.exe
2536 Un_A.exe
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082
Suspicious behavior: EnumeratesProcesses 3 IoCs

Processes:

Un_A.exe

pid process

2536 Un_A.exe
2536 Un_A.exe
2536 Un_A.exe
Suspicious use of FindShellTrayWindow 1 IoCs

Processes:

Un_A.exe

pid process

2536 Un_A.exe

pid	process
2536	Un_A.exe

pid	process
2928	aa8b2bdf7aea5d39df6921fcff7da3c813ee4c52b0773d4e82089e1f1b724d2d.exe
2536	Un_A.exe

pid	process
2536	Un_A.exe

Suspicious use of WriteProcessMemory 4 IoCs

Processes:

aa8b2bdf7aea5d39df6921fcff7da3c813ee4c52b0773d4e82089e1f1b724d2d.exe

description	pid	process	target process
PID 2928 wrote to memory of 2536	2928	aa8b2bdf7aea5d39df6921fcff7da3c813ee4c52b0773d4e82089e1f1b724d2d.exe	Un_A.exe
PID 2928 wrote to memory of 2536	2928	aa8b2bdf7aea5d39df6921fcff7da3c813ee4c52b0773d4e82089e1f1b724d2d.exe	Un_A.exe
PID 2928 wrote to memory of 2536	2928	aa8b2bdf7aea5d39df6921fcff7da3c813ee4c52b0773d4e82089e1f1b724d2d.exe	Un_A.exe
PID 2928 wrote to memory of 2536	2928	aa8b2bdf7aea5d39df6921fcff7da3c813ee4c52b0773d4e82089e1f1b724d2d.exe	Un_A.exe

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

\Users\Admin\AppData\Local\Temp\nst2751.tmp\SetupPlugin.dll

Filesize
4.5MB

MD5
46f1cd973e9deb89f48e1aecc2247570

SHA1
3fd83b5458f9ef334009dc8db43b1a4d5d9c4262

SHA256
cf52ef0a53ca25b3cf190a08ab7b3757c19293ef16892f4d6b8255fb02e0a81c

SHA512
a3f4afa4d85e073f9b8408b5b04477fc5f9bb725f4cb771dad33764d33d2526a5a52cf5adb4d907084e9c015535beb5cf766b41bf5ae3e50eafff907de9089f3

Download Submit
\Users\Admin\AppData\Local\Temp\~nsuA.tmp\Un_A.exe

Filesize
2.8MB

MD5
706b45a0453ecd341865fe74327137e4

SHA1
7afd7beed65ba72e18268944e17af0ba1e724039

SHA256
aa8b2bdf7aea5d39df6921fcff7da3c813ee4c52b0773d4e82089e1f1b724d2d

SHA512
9624c35f6b979af4f8b4d49af55a62893010c6eb9a789cc8785d67647ed27a6e02e354274697c800c9dd64cd86c658fdd02ddc804d4625b02263f1134feb3a83

Download Submit
memory/2536-14-0x00000000003F0000-0x00000000003F1000-memory.dmp

Filesize
4KB

Download