aa8b2bdf7aea5d39df6921fcff7da3c813ee4c52b0773d4e82089e1f1b724d2d

Analysis

max time kernel
133s
max time network
149s
platform
windows10-2004_x64
resource
win10v2004-20240426-en
resource tags

arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system
submitted
22-05-2024 02:19

Target

aa8b2bdf7aea5d39df6921fcff7da3c813ee4c52b0773d4e82089e1f1b724d2d.exe
Size

2.8MB
MD5

706b45a0453ecd341865fe74327137e4
SHA1

7afd7beed65ba72e18268944e17af0ba1e724039
SHA256

aa8b2bdf7aea5d39df6921fcff7da3c813ee4c52b0773d4e82089e1f1b724d2d
SHA512

9624c35f6b979af4f8b4d49af55a62893010c6eb9a789cc8785d67647ed27a6e02e354274697c800c9dd64cd86c658fdd02ddc804d4625b02263f1134feb3a83
SSDEEP

49152:xA86TbY9dfVUk0SJj/E7K2cWLcd6DX5CQDKEGwiZ0TCdcisy1Nw:xA8Gqda+2cmQ4IQDKEy9w

Score

7^/10

Executes dropped EXE 1 IoCs

Processes:

Un_A.exe

pid process

4884 Un_A.exe
Loads dropped DLL 1 IoCs

Processes:

Un_A.exe

pid process

4884 Un_A.exe
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082
Suspicious behavior: EnumeratesProcesses 6 IoCs

Processes:

Un_A.exe

pid process

4884 Un_A.exe
4884 Un_A.exe
4884 Un_A.exe
4884 Un_A.exe
4884 Un_A.exe
4884 Un_A.exe
Suspicious use of FindShellTrayWindow 1 IoCs

Processes:

Un_A.exe

pid process

4884 Un_A.exe

pid	process
4884	Un_A.exe

pid	process
4884	Un_A.exe

pid	process
4884	Un_A.exe

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

aa8b2bdf7aea5d39df6921fcff7da3c813ee4c52b0773d4e82089e1f1b724d2d.exe

description	pid	process	target process
PID 1516 wrote to memory of 4884	1516	aa8b2bdf7aea5d39df6921fcff7da3c813ee4c52b0773d4e82089e1f1b724d2d.exe	Un_A.exe
PID 1516 wrote to memory of 4884	1516	aa8b2bdf7aea5d39df6921fcff7da3c813ee4c52b0773d4e82089e1f1b724d2d.exe	Un_A.exe
PID 1516 wrote to memory of 4884	1516	aa8b2bdf7aea5d39df6921fcff7da3c813ee4c52b0773d4e82089e1f1b724d2d.exe	Un_A.exe

C:\Users\Admin\AppData\Local\Temp\aa8b2bdf7aea5d39df6921fcff7da3c813ee4c52b0773d4e82089e1f1b724d2d.exe
"C:\Users\Admin\AppData\Local\Temp\aa8b2bdf7aea5d39df6921fcff7da3c813ee4c52b0773d4e82089e1f1b724d2d.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1516

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Resource Development

Reconnaissance

C:\Users\Admin\AppData\Local\Temp\nsi34BE.tmp\SetupPlugin.dll
Filesize
4.5MB

MD5
46f1cd973e9deb89f48e1aecc2247570

SHA1
3fd83b5458f9ef334009dc8db43b1a4d5d9c4262

SHA256
cf52ef0a53ca25b3cf190a08ab7b3757c19293ef16892f4d6b8255fb02e0a81c

SHA512
a3f4afa4d85e073f9b8408b5b04477fc5f9bb725f4cb771dad33764d33d2526a5a52cf5adb4d907084e9c015535beb5cf766b41bf5ae3e50eafff907de9089f3

Download Submit
C:\Users\Admin\AppData\Local\Temp\~nsuA.tmp\Un_A.exe
Filesize
2.8MB

MD5
706b45a0453ecd341865fe74327137e4

SHA1
7afd7beed65ba72e18268944e17af0ba1e724039

SHA256
aa8b2bdf7aea5d39df6921fcff7da3c813ee4c52b0773d4e82089e1f1b724d2d

SHA512
9624c35f6b979af4f8b4d49af55a62893010c6eb9a789cc8785d67647ed27a6e02e354274697c800c9dd64cd86c658fdd02ddc804d4625b02263f1134feb3a83

Download Submit