133ad4e685e7a6e49534df9829b17ec9292473186f73a6a474bf9bad46d17855

Analysis

max time kernel
121s
max time network
121s
platform
windows7_x64
resource
win7-20240508-en
resource tags

arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system
submitted
14/06/2024, 17:28

Target

$_3_.exe
Size

1.8MB
MD5

77bfacca17ee1d89833b57f3a746d9a0
SHA1

aa9490c913489c5eafd02f67f875efcb56d23036
SHA256

38571b0965110d07c6fbf4813ab628d4017cf52c681c457fb3f184b644fb0b52
SHA512

21ecc2fce94a58cd39127964730b01722b9dafa20d3af65b023fe83188c08211ba1324849513ffc10b6a359737f98c4d06770dc1954f8880daff938a06581e6f
SSDEEP

49152:/SNY8H0ZGF5j51XdQTPRPgojx1NslvUOl/WkMWAH:oY00Z8F1XdUL

Score

3^/10

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Runs ping.exe 1 TTPs 1 IoCs

Remote System Discovery

pid	Process
964	PING.EXE

Suspicious behavior: EnumeratesProcesses 1 IoCs

pid	Process
1844	$_3_.exe

Suspicious use of SetWindowsHookEx 3 IoCs

Suspicious use of WriteProcessMemory 8 IoCs

description	pid	Process	procid_target
PID 1844 wrote to memory of 1256	1844	$_3_.exe	30
PID 1844 wrote to memory of 1256	1844	$_3_.exe	30
PID 1844 wrote to memory of 1256	1844	$_3_.exe	30
PID 1844 wrote to memory of 1256	1844	$_3_.exe	30
PID 1256 wrote to memory of 964	1256	cmd.exe	32
PID 1256 wrote to memory of 964	1256	cmd.exe	32
PID 1256 wrote to memory of 964	1256	cmd.exe	32
PID 1256 wrote to memory of 964	1256	cmd.exe	32

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Remote System Discovery

System Information Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

C:\Users\Admin\AppData\Local\Temp\15276.bat

Filesize
214B

MD5
739fcc7ba42b209fe44bea47e7a8c48f

SHA1
bc7a448a7c018133edcf012bc94301623eb42c5b

SHA256
69017cdbbe68396f45e41d211b22d800cc1afc0eadbd3440873038585020315c

SHA512
2b2b130798b0f4e534626b9fb5deaa10bb1930e6700ac0ba7cf151c1bf3239039a7032ea67ceed86a4a4dbe981064c42a8e0f88fe8361e27002dd8ceb0ea767a

Download Submit
C:\Users\Admin\AppData\Local\Temp\316F3DDBDC404370A99E580A8F486334\316F3DDBDC404370A99E580A8F486334_LogFile.txt

Filesize
9KB

MD5
a6e4b81fc1df7889a5690c3adda68751

SHA1
63c61cd691778ce38f3fac8afd099b4f4012a590

SHA256
3da6576750e4223a84e87b8edd9c4c7db7b4d0b49eb59638be60f91f04d67ec8

SHA512
1ebe45e1ade87472da1a6c5270a0b8e41b12df90dcad55950ccd410378cf99bcebb12c4027f53c0629a34cc691402752f38afe2e3298be85734d95923bf71b57

Download Submit
C:\Users\Admin\AppData\Local\Temp\316F3DDBDC404370A99E580A8F486334\316F3D~1.TXT

Filesize
105KB

MD5
b8f08b946c08f8963c18615e92ae9ea0

SHA1
56ead48787c355b54b84e047f57f1612b68c5745

SHA256
4583a2d809bac2f91a5235379d8df43bd04a39662497a9d965b1174a0a5f26ea

SHA512
fdc2b389e4c7bc7fb3320a964cec8fa553583eafb2e0e1003ec6175e62bb4a0695ac35c8078e5aa0d754e6d63519060bf0b742ec9a13cb31938c50dac6be29bd

Download Submit
memory/1844-63-0x0000000001F30000-0x0000000001F31000-memory.dmp

Filesize
4KB

Download
memory/1844-136-0x0000000001F30000-0x0000000001F31000-memory.dmp

Filesize
4KB

Download