d6777a98246377a803d8f1c20d808545de4488c99eeda6a74f456803a565906a

Analysis

max time kernel
150s
max time network
152s
platform
windows7_x64
resource
win7-20230220-en
resource tags

arch:x64arch:x86image:win7-20230220-enlocale:en-usos:windows7-x64system
submitted
14-06-2023 23:36

Target

Folio-854500047700.exe
Size

8.1MB
MD5

ec9eb9f2c9f5000ae6e4e2a3e4fd1daf
SHA1

78b5b016f5a0671db11858b2b8e683b783a44ee2
SHA256

06a39e32a13239675c197a284f06c3b933aa776ae71253791912bcb5164aa1b2
SHA512

5068eaa5466da4fde0bb5630dd6a0b42727a221d347894b35eebe7b57a4c35fc75c6a309737ec2d94a8214f4e9b2ff3efc8c7958e99de1c72adea5cc0a3b6fc2
SSDEEP

98304:QTEBexx5q1sXQc9NsFzd2aNpS/zoJcXGc5kXINYxNH:gtXQlzrpS/zfkX

Score

3^/10

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
2004	Folio-854500047700.exe

C:\Users\Admin\AppData\Local\Temp\Folio-854500047700.exe
"C:\Users\Admin\AppData\Local\Temp\Folio-854500047700.exe"
1⤵
- Suspicious use of SetWindowsHookEx
PID:2004

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

memory/2004-54-0x0000000000230000-0x0000000000231000-memory.dmp

Filesize
4KB

Download
memory/2004-55-0x0000000000400000-0x0000000000C31000-memory.dmp

Filesize
8.2MB

Download
memory/2004-56-0x0000000000230000-0x0000000000231000-memory.dmp

Filesize
4KB

Download
memory/2004-62-0x0000000000400000-0x0000000000C31000-memory.dmp

Filesize
8.2MB

Download
memory/2004-68-0x0000000000400000-0x0000000000C31000-memory.dmp

Filesize
8.2MB

Download