3a131bb4158b46ae6b2894a9a6fc02bb30f3c87bc8e48c125ce5c3c382917b10

Analysis

max time kernel
119s
max time network
121s
platform
windows7_x64
resource
win7-20231129-en
resource tags

arch:x64arch:x86image:win7-20231129-enlocale:en-usos:windows7-x64system
submitted
28/05/2024, 11:48

Target

$_3_.exe
Size

1.8MB
MD5

77bfacca17ee1d89833b57f3a746d9a0
SHA1

aa9490c913489c5eafd02f67f875efcb56d23036
SHA256

38571b0965110d07c6fbf4813ab628d4017cf52c681c457fb3f184b644fb0b52
SHA512

21ecc2fce94a58cd39127964730b01722b9dafa20d3af65b023fe83188c08211ba1324849513ffc10b6a359737f98c4d06770dc1954f8880daff938a06581e6f
SSDEEP

49152:/SNY8H0ZGF5j51XdQTPRPgojx1NslvUOl/WkMWAH:oY00Z8F1XdUL

Score

3^/10

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Runs ping.exe 1 TTPs 1 IoCs

Remote System Discovery

pid	Process
984	PING.EXE

Suspicious behavior: EnumeratesProcesses 1 IoCs

pid	Process
2304	$_3_.exe

Suspicious use of SetWindowsHookEx 3 IoCs

Suspicious use of WriteProcessMemory 8 IoCs

description	pid	Process	procid_target
PID 2304 wrote to memory of 2020	2304	$_3_.exe	30
PID 2304 wrote to memory of 2020	2304	$_3_.exe	30
PID 2304 wrote to memory of 2020	2304	$_3_.exe	30
PID 2304 wrote to memory of 2020	2304	$_3_.exe	30
PID 2020 wrote to memory of 984	2020	cmd.exe	32
PID 2020 wrote to memory of 984	2020	cmd.exe	32
PID 2020 wrote to memory of 984	2020	cmd.exe	32
PID 2020 wrote to memory of 984	2020	cmd.exe	32

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Remote System Discovery

System Information Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

C:\Users\Admin\AppData\Local\Temp\3822.bat

Filesize
214B

MD5
739fcc7ba42b209fe44bea47e7a8c48f

SHA1
bc7a448a7c018133edcf012bc94301623eb42c5b

SHA256
69017cdbbe68396f45e41d211b22d800cc1afc0eadbd3440873038585020315c

SHA512
2b2b130798b0f4e534626b9fb5deaa10bb1930e6700ac0ba7cf151c1bf3239039a7032ea67ceed86a4a4dbe981064c42a8e0f88fe8361e27002dd8ceb0ea767a

Download Submit
C:\Users\Admin\AppData\Local\Temp\BE9772138E464D02B9612D0875D42C71\BE9772138E464D02B9612D0875D42C71_LogFile.txt

Filesize
9KB

MD5
0fb3111e9310017adb5ff83b155a947d

SHA1
630586ceedfdf46a224e81d59a87721d69fafab6

SHA256
b23e58256de638887c25d48d8da248ddea5986ee22be2fdb59bc8e6448ecf69b

SHA512
857ff8f6f7f376084c78e3e0d0fa776f847998f6a7eece8965ba190c53e1d960db53c38b2c30cff04b869a4a5270764e59f94dfe7acbd5cc81107ce687ac7344

Download Submit
C:\Users\Admin\AppData\Local\Temp\BE9772138E464D02B9612D0875D42C71\BE9772~1.TXT

Filesize
110KB

MD5
e6d99c69f61773b8e861941d7ead58f0

SHA1
8854806d070b8889fb2f5877441c4ceeeb863a6c

SHA256
223f574cf7dd38b0b77a7bac8a54007547635bcc823e555d5463af339ca47217

SHA512
704ddacec5c6147d7983ee4c49b1e8e155bcf6a7e19e0122e3e1738815ef0a3d62e4b059b350bb00c466ece277168e999d11c57db22ba1edfce82167139f714e

Download Submit
memory/2304-63-0x0000000000330000-0x0000000000331000-memory.dmp

Filesize
4KB

Download
memory/2304-184-0x0000000000330000-0x0000000000331000-memory.dmp

Filesize
4KB

Download