b406f26f01869d54e6fc2b9e1732dc2c2f78fc0f8a21edd74b5369de0a6d50b4

Analysis

max time kernel
117s
max time network
118s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
28-11-2024 05:16

Target

www.exe
Size

10.5MB
MD5

48c751e8db4122d77c35ad934f8306b9
SHA1

7434cdd1e6a6264f5e4454400cbeccbc67584189
SHA256

4ce828743cb99446fb7db04f52972177af9e6df98e1b2e82755e9b504fe68bac
SHA512

084a3c7d70694960c80a329f829d20d34c05fcdc9586ffbae5c1a630e4806774ce4eb33feeb3f2d469ccfef80606526682fc2d5169838ae9c91a8133f62cda5c
SSDEEP

196608:Mt3x/ZKPvtubFVPOyBK13wv2obzhPuEBlWcR/piuFM+/juZuOx2Da+:CxiPSK13wvTzhXPn7Wyj4uO2D

Score

7^/10

Executes dropped EXE 1 IoCs

Processes:

www.exe

pid	Process
2508	www.exe

Loads dropped DLL 2 IoCs

Processes:

www.exewww.exe

pid	Process
1708	www.exe
2508	www.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

www.exe

description	pid	Process	procid_target
PID 1708 wrote to memory of 2508	1708	www.exe	32
PID 1708 wrote to memory of 2508	1708	www.exe	32
PID 1708 wrote to memory of 2508	1708	www.exe	32

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

C:\Users\Admin\AppData\Local\Temp\onefile_1708_133772445784156000\python312.dll

Filesize
6.6MB

MD5
166cc2f997cba5fc011820e6b46e8ea7

SHA1
d6179213afea084f02566ea190202c752286ca1f

SHA256
c045b57348c21f5f810bae60654ae39490846b487378e917595f1f95438f9546

SHA512
49d9d4df3d7ef5737e947a56e48505a2212e05fdbcd7b83d689639728639b7fd3be39506d7cfcb7563576ebee879fd305370fdb203909ed9b522b894dd87aacb

Download Submit
\Users\Admin\AppData\Local\Temp\onefile_1708_133772445784156000\www.exe

Filesize
14.5MB

MD5
5ff92691ce8919b8ad899ce7d7dcecc5

SHA1
05255658f0340905f753b9a96fe6303196cb1f7f

SHA256
3140e5d3820e3e40957e4e638ffabea93d61994cf00f17f976e353ccf7c15930

SHA512
c1f2a96a8241e57669e2b8c8844799db5c944b8c82eea802c370a86c6b90c7e0ea45f33a007460872fd1fd83f7f0250b10e97f78d879f2530c1df1e0298f5548

Download Submit