cc24fb493ea2e8b879429b3d4a475d2f9abc4a3ccca61fdbfdbe3a71af16d722

Analysis

max time kernel
119s
max time network
120s
platform
windows7_x64
resource
win7-20240508-en
resource tags

arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system
submitted
24-05-2024 02:51

Target

main.exe
Size

20.8MB
MD5

a18229feee8fd2a2d11caf3334962724
SHA1

4c1a078607d9cb97103bfb3122be3b45bdeff817
SHA256

b9c4ebecf944e0e9955f86a7581b3b02187ce64e78011035dedab40377ee3001
SHA512

fc35eb60b4ab3014c680e4fdb2c54eea08ee7480c6c765402985be532d3465bd28317482b0e4f4cd2e69b4691a5a19974e2e8229b1001269fbd189d14b82c37a
SSDEEP

393216:qdjJmE6NrDREnCE8odCMiqwmtD/BFZTFjRUpLHfKg4NMaTSzmGg37P:6JmE6hDOnCE84CMMmt7XepL/KQajGg37

Score

7^/10

Executes dropped EXE 1 IoCs

Processes:

main.exe

pid process

2632 main.exe
Loads dropped DLL 2 IoCs

Processes:

main.exemain.exe

pid process

2064 main.exe
2632 main.exe
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

pid	process
2632	main.exe

pid	process
2064	main.exe
2632	main.exe

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

main.exe

description	pid	process	target process
PID 2064 wrote to memory of 2632	2064	main.exe	main.exe
PID 2064 wrote to memory of 2632	2064	main.exe	main.exe
PID 2064 wrote to memory of 2632	2064	main.exe	main.exe

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

C:\Users\Admin\AppData\Local\Temp\onefile_2064_133609927525472000\python311.dll

Filesize
5.5MB

MD5
9a24c8c35e4ac4b1597124c1dcbebe0f

SHA1
f59782a4923a30118b97e01a7f8db69b92d8382a

SHA256
a0cf640e756875c25c12b4a38ba5f2772e8e512036e2ac59eb8567bf05ffbfb7

SHA512
9d9336bf1f0d3bc9ce4a636a5f4e52c5f9487f51f00614fc4a34854a315ce7ea8be328153812dbd67c45c75001818fa63317eba15a6c9a024fa9f2cab163165b

Download Submit
\Users\Admin\AppData\Local\Temp\onefile_2064_133609927525472000\main.exe

Filesize
41.9MB

MD5
d8143edadc864c42daec34549563b607

SHA1
98ce03685f3684cb22ce14e08481f04d3d2959c6

SHA256
d3874a36ed2f12957873843f7b63c80bb36bb22cbb8d4ea08002b0ba228d0f55

SHA512
cac11f6d74097f75888f1604338ade403929e42ee4420853f552bf4d18fba51f79faefadae5751ed218f69c15324a09e2bdf3ff12150c40707b38a2079901cda

Download Submit
memory/2064-133-0x000000013F970000-0x0000000140E58000-memory.dmp

Filesize
20.9MB

Download
memory/2632-68-0x000000013F990000-0x000000014242E000-memory.dmp

Filesize
42.6MB

Download