b5a7df1bce14af47db87f45e2ee5c2f53408d181da89d3490298e49714902a03

Analysis

max time kernel
139s
max time network
125s
platform
windows10-2004_x64
resource
win10v2004-20240709-en
resource tags

arch:x64arch:x86image:win10v2004-20240709-enlocale:en-usos:windows10-2004-x64system
submitted
19/07/2024, 08:52

Target

IcqUpdater.exe
Size

78KB
MD5

45a7dc82d6914024e6bc0b9f35a7ff47
SHA1

91ef4ce6bf687a56fd01fff34fcc0a2c94e0574c
SHA256

a27dc336190955445785b1611a20b42492bef29573e67b36a15df3917f967337
SHA512

0e88d78e683fe1b96aad44d7c3029ed54a1866b8c727cbfb2e88e354894847f378b8c297b4d7f7b8f71a1fadc8852a1ce7c373e8065f6f15dd33d8e046a70da4
SSDEEP

1536:8tqy/tCwz6WKHRwmUIoY7XPTKFxgeoz8VVET68:XYtj0bmF2eoz8bETl

Score

3^/10

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-701583114-2636601053-947405450-1000_Classes\Local Settings	IcqUpdater.exe

C:\Users\Admin\AppData\Local\Temp\IcqUpdater.exe
"C:\Users\Admin\AppData\Local\Temp\IcqUpdater.exe"
1⤵
- Modifies registry class
PID:3376

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:1484

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact