c7a4a3d6a33ff2999f26c7721c84267137196479abbbb161de5d360fa3f64bc3

Analysis

max time kernel
0s
max time network
150s
platform
windows7_x64
resource
win7-20240508-en
resource tags

arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system
submitted
01-07-2024 02:36

Target

c7a4a3d6a33ff2999f26c7721c84267137196479abbbb161de5d360fa3f64bc3.exe
Size

84KB
MD5

92f03bdeba91e719ce9a81dc18ddda10
SHA1

471ce1bd129991c37b32394dae1217d3b5ff93ea
SHA256

c7a4a3d6a33ff2999f26c7721c84267137196479abbbb161de5d360fa3f64bc3
SHA512

bb41008d21ef6bceb50ed94da08e2b5722d9a7e9d498fe6dc17328ca5252fe1cc6f558735d4cff0402d5b70caed58cd286f22949fe423b25fca77bdba288ad88
SSDEEP

1536:IGsBuoFn7UZ+LtdgI2MyzNORQtOflIwoHNV2XBFV72B4lA7ZsbI8zq:IGjot7UQLtdgI2MyzNORQtOflIwoHNVt

Score

7^/10

Executes dropped EXE 1 IoCs

Processes:

kgfdfjdk.exe

pid process

2136 kgfdfjdk.exe
Loads dropped DLL 1 IoCs

Processes:

c7a4a3d6a33ff2999f26c7721c84267137196479abbbb161de5d360fa3f64bc3.exe

pid process

2476 c7a4a3d6a33ff2999f26c7721c84267137196479abbbb161de5d360fa3f64bc3.exe
Creates a large amount of network flows 1 TTPs
This may indicate a network scan to discover remotely running services.
discovery

Network Service Discovery
T1046
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

pid	process
2136	kgfdfjdk.exe

pid	process
2476	c7a4a3d6a33ff2999f26c7721c84267137196479abbbb161de5d360fa3f64bc3.exe

Suspicious use of WriteProcessMemory 4 IoCs

Processes:

c7a4a3d6a33ff2999f26c7721c84267137196479abbbb161de5d360fa3f64bc3.exe

description	pid	process	target process
PID 2476 wrote to memory of 2136	2476	c7a4a3d6a33ff2999f26c7721c84267137196479abbbb161de5d360fa3f64bc3.exe	kgfdfjdk.exe
PID 2476 wrote to memory of 2136	2476	c7a4a3d6a33ff2999f26c7721c84267137196479abbbb161de5d360fa3f64bc3.exe	kgfdfjdk.exe
PID 2476 wrote to memory of 2136	2476	c7a4a3d6a33ff2999f26c7721c84267137196479abbbb161de5d360fa3f64bc3.exe	kgfdfjdk.exe
PID 2476 wrote to memory of 2136	2476	c7a4a3d6a33ff2999f26c7721c84267137196479abbbb161de5d360fa3f64bc3.exe	kgfdfjdk.exe

C:\Users\Admin\AppData\Local\Temp\kgfdfjdk.exe
"C:\Users\Admin\AppData\Local\Temp\kgfdfjdk.exe"
2⤵
- Executes dropped EXE
PID:2136

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Network Service Discovery

System Information Discovery

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Resource Development

Reconnaissance

C:\Users\Admin\AppData\Local\Temp\kgfdfjdk.exe
Filesize
84KB

MD5
9228628d4fac960e3edcfa86148d8ea7

SHA1
1898b315b346462c456b3c9d9f2c2b921a579ec6

SHA256
05baf647a0ae90143603508eebe337f0c97482ae8310dbb9243870b76adcc7e4

SHA512
924ee05966ae9b47af0871710b32cf3cf6a00f7659404b6a1ad7ec7d68c354c8c4cc8e7009b4337871edd1793702869d7fa67be7243ddb560df0d81d66c39177

Download Submit
memory/2136-12-0x0000000003500000-0x0000000003516000-memory.dmp

Filesize
88KB

Download
memory/2136-11-0x0000000000250000-0x0000000000255000-memory.dmp

Filesize
20KB

Download
memory/2476-1-0x0000000003500000-0x0000000003516000-memory.dmp

Filesize
88KB

Download
memory/2476-2-0x0000000001B00000-0x0000000001B05000-memory.dmp

Filesize
20KB

Download
memory/2476-9-0x0000000003500000-0x0000000003516000-memory.dmp

Filesize
88KB

Download
memory/2476-6-0x0000000002A10000-0x0000000002A26000-memory.dmp

Filesize
88KB

Download