633a5d3f0792c5e90ab1c42ca2abb692b30904efffd5a4537a7b3d7977d2cc42 | Triage

Analysis

max time kernel
84s
max time network
129s
platform
windows10-2004_x64
resource
win10v2004-20230220-en
resource tags

arch:x64arch:x86image:win10v2004-20230220-enlocale:en-usos:windows10-2004-x64system
submitted
31/03/2023, 08:52

Sharing

Report Analysis Logs

General

Target

3389端口修改.exe
Size

40KB
MD5

80c4d8a83ec354f001be13a1f669216e
SHA1

4570bfeed721bdb2568d8f7c76f8193805c251d4
SHA256

633a5d3f0792c5e90ab1c42ca2abb692b30904efffd5a4537a7b3d7977d2cc42
SHA512

a338398951825abdec96166d6bf262719b5fcf436a2817909e22a13040c117b910577301d903bb730112ae96259eecc36c72d0f7442612d67682b2cd0be90fd0
SSDEEP

768:4aG1FMWYTjmoKATjvqzzO4V9Pgi/M/0SP0dzxx:4aG1fYTjmoKAanRV9zdSP+zxx

Score

8^/10

Malware Config

Signatures

Modifies RDP port number used by Windows 1 TTPs

Remote Desktop Protocol
T1076

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
4548	3389端口修改.exe
4548	3389端口修改.exe

C:\Users\Admin\AppData\Local\Temp\3389端口修改.exe
"C:\Users\Admin\AppData\Local\Temp\3389端口修改.exe"
1⤵
- Suspicious use of SetWindowsHookEx
PID:4548

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Lateral Movement

Remote Desktop Protocol

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads