5018198754f5f7c082c0ec7df62f89f86403d9075145584a662ba4f0f2141723

Analysis

max time kernel
150s
max time network
150s
platform
windows7_x64
resource
win7-20240419-en
resource tags

arch:x64arch:x86image:win7-20240419-enlocale:en-usos:windows7-x64system
submitted
27-04-2024 22:17

Target

$EXEFILE.exe
Size

386KB
MD5

a2dab622fea96605b06acb6982d6bf11
SHA1

7b21f23cfa9de0220c6d0d10c4a1d6c63e1621bd
SHA256

b6c6fd59bd0ee85112bf9d83504189137d38157231043a482eb6e1f2c25a299d
SHA512

67172b3ea35ec44e7f9f897d6b864e0a4985d7543e8582cb704873cd9e429d03274a59e614c0eb61b9f0cab905d13da66e9459e749eb03695b804b946b55ac72
SSDEEP

6144:zml+LRTFd13PwlJ8uVEqzmABOiwmjY06D:zZFTl/wsQ9OiVjY

Score

3^/10

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082
Suspicious use of SetWindowsHookEx 2 IoCs

Processes:

$EXEFILE.exe

pid process

1320 $EXEFILE.exe
1320 $EXEFILE.exe

pid	process
1320	$EXEFILE.exe
1320	$EXEFILE.exe

C:\Users\Admin\AppData\Local\Temp\$EXEFILE.exe
"C:\Users\Admin\AppData\Local\Temp\$EXEFILE.exe"
1⤵
- Suspicious use of SetWindowsHookEx
PID:1320

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Resource Development

Reconnaissance

memory/1320-0-0x0000000000270000-0x000000000027C000-memory.dmp

Filesize
48KB

Download
memory/1320-1-0x000007FEF5FA0000-0x000007FEF693D000-memory.dmp

Filesize
9.6MB

Download
memory/1320-2-0x0000000000410000-0x0000000000490000-memory.dmp

Filesize
512KB

Download
memory/1320-3-0x000007FEF5FA0000-0x000007FEF693D000-memory.dmp

Filesize
9.6MB

Download
memory/1320-4-0x000007FEF5FA0000-0x000007FEF693D000-memory.dmp

Filesize
9.6MB

Download
memory/1320-5-0x0000000000410000-0x0000000000490000-memory.dmp

Filesize
512KB

Download
memory/1320-6-0x0000000000410000-0x0000000000490000-memory.dmp

Filesize
512KB

Download
memory/1320-7-0x0000000000410000-0x0000000000490000-memory.dmp

Filesize
512KB

Download
memory/1320-8-0x0000000000410000-0x0000000000490000-memory.dmp

Filesize
512KB

Download
memory/1320-9-0x0000000000410000-0x0000000000490000-memory.dmp

Filesize
512KB

Download
memory/1320-10-0x0000000000410000-0x0000000000490000-memory.dmp

Filesize
512KB

Download
memory/1320-11-0x0000000000410000-0x0000000000490000-memory.dmp

Filesize
512KB

Download
memory/1320-12-0x0000000000410000-0x0000000000490000-memory.dmp

Filesize
512KB

Download
memory/1320-13-0x0000000000410000-0x0000000000490000-memory.dmp

Filesize
512KB

Download