dffb606169831b2baea5de7c081ea21f11dfd70224ba90e3f39d4734981b02c6

Analysis

max time kernel
14s
max time network
19s
platform
windows7_x64
resource
win7-20240704-en
resource tags

arch:x64arch:x86image:win7-20240704-enlocale:en-usos:windows7-x64system
submitted
25/07/2024, 18:53

Target

zhongaclient by zhong 0.0.7 p75/main1.css
Size

115KB
MD5

68194f5ef60e18898f979aea8c51e77e
SHA1

f4ef53e3e65f1083781840c67ce7753f6347bae4
SHA256

393a3de3bbf299645795394feef5258fd3dfae36e2caac5d9257b2491803c460
SHA512

6785df06cc570ff8d3387511d49729daefc7eb4d96aecb82cc41e45cf6bfdd35ab44c3f34d7fafe8e913ae76b3f15ab5972bf00254bb26501d77af4adc7c0dfb
SSDEEP

3072:pMQg/ZUnePf/ujy3f4cePf/ujy3f4Z1g5xhZcdx2CJQVdpV4JVC6RghZhhEVpumN:pMQg/ZEePf/ujy3f4cePf/ujy3f4Z1gC

Score

3^/10

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2960 wrote to memory of 2896	2960	cmd.exe	31
PID 2960 wrote to memory of 2896	2960	cmd.exe	31
PID 2960 wrote to memory of 2896	2960	cmd.exe	31

C:\Windows\system32\cmd.exe
cmd /c "C:\Users\Admin\AppData\Local\Temp\zhongaclient by zhong 0.0.7 p75\main1.css"
1⤵
- Suspicious use of WriteProcessMemory
PID:2960
- C:\Windows\system32\NOTEPAD.EXE
  "C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\AppData\Local\Temp\zhongaclient by zhong 0.0.7 p75\main1.css
  2⤵
  PID:2896

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact