aaa5acac0791640451492c3b1f8ccf4cf9937eb32ea6bdb39b9afc2eb214602a

Analysis

max time kernel
121s
max time network
122s
platform
windows7_x64
resource
win7-20240611-en
resource tags

arch:x64arch:x86image:win7-20240611-enlocale:en-usos:windows7-x64system
submitted
12-06-2024 17:22

Target

locales.7z
Size

15.5MB
MD5

4448307411c2e146cd3b799287127ff8
SHA1

711f109c45bbfcbd5a6f640d5d1aa21c6d87000c
SHA256

aaa5acac0791640451492c3b1f8ccf4cf9937eb32ea6bdb39b9afc2eb214602a
SHA512

82ba7f970e67e971783ae6a30249d7d4829467802fa6697f2c74b76fced305126562722a5abdd819e33f61496e128ea06936d5df3310ded09c0b774d7ad0394b
SSDEEP

393216:nSkp7rSRYn7Hk+yiUywCGHAqUDJnl/362ECZTiuZP2SME9WY:nSkZSRY7E1ipEAqUDJnl/369CZTiqPdD

Score

3^/10

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2812790648-3157963462-487717889-1000_Classes\Local Settings	rundll32.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 1916 wrote to memory of 2724	1916	cmd.exe	29
PID 1916 wrote to memory of 2724	1916	cmd.exe	29
PID 1916 wrote to memory of 2724	1916	cmd.exe	29

C:\Windows\system32\cmd.exe
cmd /c C:\Users\Admin\AppData\Local\Temp\locales.7z
1⤵
- Suspicious use of WriteProcessMemory
PID:1916
- C:\Windows\system32\rundll32.exe
  "C:\Windows\system32\rundll32.exe" C:\Windows\system32\shell32.dll,OpenAs_RunDLL C:\Users\Admin\AppData\Local\Temp\locales.7z
  2⤵
  - Modifies registry class
  PID:2724

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact