35288cc9856deb3cd3a5d47364073420671b323fb0d887621e47b69f53a24ceb

Analysis

max time kernel
120s
max time network
122s
platform
windows7_x64
resource
win7-20240704-en
resource tags

arch:x64arch:x86image:win7-20240704-enlocale:en-usos:windows7-x64system
submitted
20/07/2024, 07:31

Target

BoanSupport.exe
Size

5.1MB
MD5

7563452b1cbb9954602bab1313bc3531
SHA1

0d4096cb36d1efb02bc707368bc48e2abb3a0504
SHA256

ed56da24442303141588cf9cfe7e38a971aaf5ba1a60764117189b13577347ba
SHA512

fb84e2735490f90a56cac337f9c6e1465294f16eecd8ecf36b688115ac21626f6192483761c0d4a5d90207667bb7197e793e8c52410436c2ded3df31f0ffb688
SSDEEP

12288:yMHC2ESCu95o+RLbzLyLMJRpW/rjssLVIHBgJH+7mxxJkYXOVu:9HC2ESC6beLMkssKhNy

Score

3^/10

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
3064	BoanSupport.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 3064 wrote to memory of 1640	3064	BoanSupport.exe	28
PID 3064 wrote to memory of 1640	3064	BoanSupport.exe	28
PID 3064 wrote to memory of 1640	3064	BoanSupport.exe	28
PID 3064 wrote to memory of 1640	3064	BoanSupport.exe	28

C:\Users\Admin\AppData\Local\Temp\BoanSupport.exe
"C:\Users\Admin\AppData\Local\Temp\BoanSupport.exe"
1⤵
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3064
- C:\Windows\SysWOW64\schtasks.exe
  "C:\Windows\System32\schtasks.exe" /tn:"BoanSupport" /run
  2⤵
  PID:1640

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact