fd0544bdeb691b88a388b2a51da072c4de37b5f7d9af2a1948d45aed755a80a2

Analysis

max time kernel
119s
max time network
120s
platform
windows7_x64
resource
win7-20240419-en
resource tags

arch:x64arch:x86image:win7-20240419-enlocale:en-usos:windows7-x64system
submitted
08/06/2024, 16:09

Target
Electric.rar
Size 37.9MB
Sample240608-tl7jpsea65
SHA256 fd0544bdeb691b88a388b2a51da072c4de37b5f7d9af2a1948d45aed755a80a2
MD5 ed01b80849a848fc3c1285abb66cba4c
SHA1 23cc1b1f8dad47f86dabf71110f6ebfe9c854c12
SHA512 5e0d254690d7f13bf783e905c2481d73ba570fc623d4af4038b3c75fd4e09f45a3185357403d91b4b1d1d4a59ce03b37571b9383b296f5490eba240d690c1853
SSDEEP 786432:Hh5fSYddhTmrs+5ofByRhgYykOF0InSVgEI2/GfEDP6hgkmrvBmYLXWCi:BVSYzhqw2o5J6ISVgEvYo6hgk+fLXWB
MD5 SHA1 SHA512 SSDEEP

Score

3^/10

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000_Classes\Local Settings	rundll32.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 1964 wrote to memory of 2644	1964	cmd.exe	29
PID 1964 wrote to memory of 2644	1964	cmd.exe	29
PID 1964 wrote to memory of 2644	1964	cmd.exe	29

C:\Windows\system32\cmd.exe
cmd /c C:\Users\Admin\AppData\Local\Temp\Electric.rar
1⤵
- Suspicious use of WriteProcessMemory
PID:1964
- C:\Windows\system32\rundll32.exe
  "C:\Windows\system32\rundll32.exe" C:\Windows\system32\shell32.dll,OpenAs_RunDLL C:\Users\Admin\AppData\Local\Temp\Electric.rar
  2⤵
  - Modifies registry class
  PID:2644

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact