81b02e400c3f13cf7a0d225fb7606239cef329fbf78adb9050b25ce36f6356f1

Analysis

max time kernel
11s
max time network
15s
platform
windows7_x64
resource
win7-20240704-en
resource tags

arch:x64arch:x86image:win7-20240704-enlocale:en-usos:windows7-x64system
submitted
20/07/2024, 17:21

Target

0506f2c306f1eb3760e3931573bda550N.exe
Size

208KB
MD5

0506f2c306f1eb3760e3931573bda550
SHA1

f16af8370c4ee038d839b5dbe7baaa61edc3d8bb
SHA256

81b02e400c3f13cf7a0d225fb7606239cef329fbf78adb9050b25ce36f6356f1
SHA512

dcc95e89c9df99376a3a5186642fb7072a0173c8995151ab31a30a4f7c5cd374effd969b73ce09be209f17eeaa0370b468d128eaac8b40e9e905bda7d9588ba3
SSDEEP

6144:7AS6gyCdizgZu8u/yVfkbf+efjnnuI66RNQEj:7A9CdizgZu8u/b7+efjnnu16RNQ

Score

7^/10

Executes dropped EXE 1 IoCs

pid	Process
2808	OKPY.exe

Loads dropped DLL 2 IoCs

pid	Process
2812	cmd.exe
2812	cmd.exe

Drops file in System32 directory 3 IoCs

description	ioc	Process
File created	C:\windows\SysWOW64\OKPY.exe	0506f2c306f1eb3760e3931573bda550N.exe
File opened for modification	C:\windows\SysWOW64\OKPY.exe	0506f2c306f1eb3760e3931573bda550N.exe
File created	C:\windows\SysWOW64\OKPY.exe.bat	0506f2c306f1eb3760e3931573bda550N.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
2796	0506f2c306f1eb3760e3931573bda550N.exe
2808	OKPY.exe

Suspicious use of SetWindowsHookEx 4 IoCs

Suspicious use of WriteProcessMemory 8 IoCs

description	pid	Process	procid_target
PID 2796 wrote to memory of 2812	2796	0506f2c306f1eb3760e3931573bda550N.exe	29
PID 2796 wrote to memory of 2812	2796	0506f2c306f1eb3760e3931573bda550N.exe	29
PID 2796 wrote to memory of 2812	2796	0506f2c306f1eb3760e3931573bda550N.exe	29
PID 2796 wrote to memory of 2812	2796	0506f2c306f1eb3760e3931573bda550N.exe	29
PID 2812 wrote to memory of 2808	2812	cmd.exe	31
PID 2812 wrote to memory of 2808	2812	cmd.exe	31
PID 2812 wrote to memory of 2808	2812	cmd.exe	31
PID 2812 wrote to memory of 2808	2812	cmd.exe	31

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

C:\Windows\SysWOW64\OKPY.exe.bat

Filesize
72B

MD5
72e573dbbc7d9490f554451d4d8b2299

SHA1
86afc265700806156546f0f41bb2104a269fd316

SHA256
18cc6dfd78f2be5e93227b188f5b1b23f4024feb184cab689d94ee65c75f37f8

SHA512
3146091c8ea345b9c5908139314074918ad5addb38836154d540f29057a6822154e7eadd7224e655914cc0c46566dd3d76cf1960bd793fe9514839893029259d

Download Submit
\Windows\SysWOW64\OKPY.exe

Filesize
208KB

MD5
4d0d5aecff8d44e08053d039a27a9009

SHA1
93afb4b87a2ecaef2d32d71ecabcb868c6859d19

SHA256
1b62b136f3519819086de5bf38aafa2c3933b48684ec52ba2a742b470a6b4115

SHA512
2cc6a17b44d5c5c945334fc9bc8dcde32a90c78410756623549752886ee9d2474c423c059ca4f09cb8189cdb3c392480e5c5d7c313c866c04b4c1cba00c72603

Download Submit
memory/2796-0-0x0000000000400000-0x0000000000438000-memory.dmp

Filesize
224KB

Download
memory/2796-12-0x0000000000400000-0x0000000000438000-memory.dmp

Filesize
224KB

Download
memory/2808-20-0x0000000000400000-0x0000000000438000-memory.dmp

Filesize
224KB

Download
memory/2808-21-0x0000000000400000-0x0000000000438000-memory.dmp

Filesize
224KB

Download
memory/2812-18-0x00000000001C0000-0x00000000001F8000-memory.dmp

Filesize
224KB

Download
memory/2812-17-0x00000000001C0000-0x00000000001F8000-memory.dmp

Filesize
224KB

Download