21b6a28df6984d1e4822af45b5e4da96672fd52c572709b5ec0c10a254c5ebc5

Analysis

max time kernel
118s
max time network
119s
platform
windows7_x64
resource
win7-20240220-en
resource tags

arch:x64arch:x86image:win7-20240220-enlocale:en-usos:windows7-x64system
submitted
23-05-2024 01:51

Target

2345PinyinMiniPage.exe
Size

1.1MB
MD5

2c515a314b4eed803687f4f60633fda1
SHA1

53ac20e23b200422bd6a483c9b02251020f917f5
SHA256

32ff4f980acbe90eaa3f1335c7fccf9656209cb92e70dd1637d910941254ee48
SHA512

9d6a1959707776199961aabceb85f6306f2b1f7d6d68bf5cbccdb39d801d7742eb1ae396f2b0e946df58579b8465930b86dd27d216302cc53c1945596fbca770
SSDEEP

24576:bS1Xq5oMxw1wkGbpn2nu8bJ3yPwSlE5ElsT0H2HSz5rEN8R0:AVMx6J3yoSlE5ElsT0ySz5rEN8R

Score

3^/10

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious behavior: EnumeratesProcesses 7 IoCs

Processes:

2345PinyinMiniPage.exe

C:\Users\Admin\AppData\Local\Temp\2345PinyinMiniPage.exe
"C:\Users\Admin\AppData\Local\Temp\2345PinyinMiniPage.exe"
1⤵
- Suspicious behavior: EnumeratesProcesses
PID:2912

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

C:\Users\Admin\AppData\Roaming\MiniPage_2345\2345MiniPage.CheckVersion.data

Filesize
29B

MD5
99fb8e84b8aa92889349054a60e1f359

SHA1
1b3dd1afb4fe4533ca16db4dd3e7845c13b0e1c5

SHA256
5313e624a817ebcb34675027d12b87465de4fc4fdddfdd74d244490c4911b8e4

SHA512
2a99095109445c3ca1b9fad5c87fdfed331641401ca8d19d3ab4d109e18b9dc5feb739485f14f390bd3bcfa3a4325e3b1278fe1bb8690dd8df16edb9af52faac

Download Submit