4d07a2b0ebb01f02421f61ad6bd0a931c1e1d3c8803467193e66f4a58b0b93d4

Analysis

max time kernel
122s
max time network
129s
platform
windows7_x64
resource
win7-20241010-en
resource tags

arch:x64arch:x86image:win7-20241010-enlocale:en-usos:windows7-x64system
submitted
26-11-2024 10:55

Target

4d07a2b0ebb01f02421f61ad6bd0a931c1e1d3c8803467193e66f4a58b0b93d4.exe
Size

12.5MB
MD5

2c30f292a8d28a0e496bc8ff068e95aa
SHA1

39f45ee2f8ed727630f60878a4bd8391a7b1dbe5
SHA256

4d07a2b0ebb01f02421f61ad6bd0a931c1e1d3c8803467193e66f4a58b0b93d4
SHA512

fc09bef73f366354a206d8d33250fe8d4934d45c791e0909e2091f7f2db01f55ad0d8a888866eedec992dda481f38cdb6470b2e08f0791525220f0e6a534b445
SSDEEP

196608:3WxUHB2XJmZ7JVPvmlwlkGWRd1IS+1nZSOwJ3Y7ao5aN1a7CEfGGcXNm:3WxUhLPmlGAdeSO8Owtmgo7CEn8g

Score

7^/10

Executes dropped EXE 1 IoCs

Processes:

Insta乗っ取り.exe

pid	Process
2164	Insta乗っ取り.exe

Loads dropped DLL 2 IoCs

Processes:

4d07a2b0ebb01f02421f61ad6bd0a931c1e1d3c8803467193e66f4a58b0b93d4.exeInsta乗っ取り.exe

pid	Process
844	4d07a2b0ebb01f02421f61ad6bd0a931c1e1d3c8803467193e66f4a58b0b93d4.exe
2164	Insta乗っ取り.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

4d07a2b0ebb01f02421f61ad6bd0a931c1e1d3c8803467193e66f4a58b0b93d4.exe

description	pid	Process	procid_target
PID 844 wrote to memory of 2164	844	4d07a2b0ebb01f02421f61ad6bd0a931c1e1d3c8803467193e66f4a58b0b93d4.exe	30
PID 844 wrote to memory of 2164	844	4d07a2b0ebb01f02421f61ad6bd0a931c1e1d3c8803467193e66f4a58b0b93d4.exe	30
PID 844 wrote to memory of 2164	844	4d07a2b0ebb01f02421f61ad6bd0a931c1e1d3c8803467193e66f4a58b0b93d4.exe	30

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

C:\Users\Admin\AppData\Local\Temp\onefile_844_133770921557574000\python312.dll

Filesize
6.6MB

MD5
166cc2f997cba5fc011820e6b46e8ea7

SHA1
d6179213afea084f02566ea190202c752286ca1f

SHA256
c045b57348c21f5f810bae60654ae39490846b487378e917595f1f95438f9546

SHA512
49d9d4df3d7ef5737e947a56e48505a2212e05fdbcd7b83d689639728639b7fd3be39506d7cfcb7563576ebee879fd305370fdb203909ed9b522b894dd87aacb

Download Submit
\Users\Admin\AppData\Local\Temp\onefile_844_133770921557574000\Insta乗っ取り.exe

Filesize
22.1MB

MD5
cf8afc9f6cda00015343bc8f899cb295

SHA1
01c40863b71267a0b06c6703187f4647b574c2e1

SHA256
45094625308be5f3565eb9226e2963cd7ff3f94370c224f358d6143cbfe17bc7

SHA512
8a68fb7563987b637752de4dce80e536481f2a74f1a5137b5a5483520bb7c3fe61c854b4395c30df2c46ba8658f539c92aeb436c8bcabcdc6ec14a9d109d9e49

Download Submit
memory/844-59-0x000000013F0A0000-0x000000013FD43000-memory.dmp

Filesize
12.6MB

Download
memory/2164-32-0x000000013FCF0000-0x0000000141354000-memory.dmp

Filesize
22.4MB

Download