36b7f4a622103d25a516973e8db7c4b1334465a9eb1ce4ba0ba08b05f6fcd229

Analysis

max time kernel
129s
max time network
102s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
04/06/2024, 15:17

Target
36b7f4a622103d25a516973e8db7c4b1334465a9eb1ce4ba0ba08b05f6fcd229.exe
Size 500KB
Sample240604-sn5x8abc8s
SHA256 36b7f4a622103d25a516973e8db7c4b1334465a9eb1ce4ba0ba08b05f6fcd229
MD5 6891bb0f887e42607ed8a657294f9ac5
SHA1 ee3f543d006363ba1c5d0415dbdff5073360be26
SHA512 aef0bcbd0ed829fed7d19dfacc314984ddb8ecde8e6d04b55838d8e5912e4322e23b389f2e01749c19f1e4e55f0ff63299df5988f662c15413814b98f206ee36
SSDEEP 12288:d+Oa75wxpzAZu9/46A9jmP/uhu/yMS08CkntxYR:IR75tpfmP/UDMS08Ckn3
MD5 SHA1 SHA512 SSDEEP

Score

3^/10

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious use of SetWindowsHookEx 3 IoCs

pid	Process
3896	36b7f4a622103d25a516973e8db7c4b1334465a9eb1ce4ba0ba08b05f6fcd229.exe
3896	36b7f4a622103d25a516973e8db7c4b1334465a9eb1ce4ba0ba08b05f6fcd229.exe
3896	36b7f4a622103d25a516973e8db7c4b1334465a9eb1ce4ba0ba08b05f6fcd229.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 3896 wrote to memory of 2472	3896	36b7f4a622103d25a516973e8db7c4b1334465a9eb1ce4ba0ba08b05f6fcd229.exe	84
PID 3896 wrote to memory of 2472	3896	36b7f4a622103d25a516973e8db7c4b1334465a9eb1ce4ba0ba08b05f6fcd229.exe	84
PID 3896 wrote to memory of 2472	3896	36b7f4a622103d25a516973e8db7c4b1334465a9eb1ce4ba0ba08b05f6fcd229.exe	84

C:\Users\Admin\AppData\Local\Temp\36b7f4a622103d25a516973e8db7c4b1334465a9eb1ce4ba0ba08b05f6fcd229.exe
"C:\Users\Admin\AppData\Local\Temp\36b7f4a622103d25a516973e8db7c4b1334465a9eb1ce4ba0ba08b05f6fcd229.exe"
1⤵
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3896
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c C:\Users\Admin\AppData\Local\Temp\
  2⤵
  PID:2472

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact