300f072c7d3530455a17f00ac7733a7630f7639e4a8afce3fd3f181324fddbc8 | Triage

Analysis

max time kernel
134s
max time network
145s
platform
windows10-2004_x64
resource
win10v2004-20230220-en
resource tags

arch:x64arch:x86image:win10v2004-20230220-enlocale:en-usos:windows10-2004-x64system
submitted
18-05-2023 11:14

Sharing

Report Analysis Logs

General

Target

sample_01.exe
Size

42KB
MD5

de3b1dc2e2b45aabff72291e19208acc
SHA1

4ae717558b31943de239500d55e1f6acda413857
SHA256

300f072c7d3530455a17f00ac7733a7630f7639e4a8afce3fd3f181324fddbc8
SHA512

9620abe996089c0529be6c12952520433d9d20aa5f8676e472d3659baf3bb953902c05fa9570a71f483b2ffd408de9778b546a95dc0f90971dd50d1f58c88884
SSDEEP

768:NKBm2CDZgq5d8+BWXWtEXmn4YsOv6hdRbQVT+2sddE:4xg5lWEhyuJSdE

Score

4^/10

Malware Config

Signatures

Drops file in Windows directory 5 IoCs

description	ioc	Process
File created	\??\c:\windows\system\ashley.vbs	sample_01.exe
File created	C:\windows\display.txt	sample_01.exe
File created	C:\windows\system\ashley_secret_xxx_diary.exe	sample_01.exe
File opened for modification	C:\windows\system\ashley_secret_xxx_diary.exe	sample_01.exe
File created	C:\WINDOWS\All Users\Start Menu\Programs\StartUp\Explorer.exe	sample_01.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
920	sample_01.exe

C:\Users\Admin\AppData\Local\Temp\sample_01.exe
"C:\Users\Admin\AppData\Local\Temp\sample_01.exe"
1⤵
- Drops file in Windows directory
- Suspicious use of SetWindowsHookEx
PID:920

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/920-133-0x0000000000400000-0x000000000040D000-memory.dmp

Filesize
52KB

Download