06a39e32a13239675c197a284f06c3b933aa776ae71253791912bcb5164aa1b2 | Triage

Analysis

max time kernel
141s
max time network
121s
platform
windows10-2004_x64
resource
win10v2004-20230220-en
resource tags

arch:x64arch:x86image:win10v2004-20230220-enlocale:en-usos:windows10-2004-x64system
submitted
17/06/2023, 01:56

Sharing

Report Analysis Logs

General

Target

Folio-854500047700.exe
Size

8.1MB
MD5

ec9eb9f2c9f5000ae6e4e2a3e4fd1daf
SHA1

78b5b016f5a0671db11858b2b8e683b783a44ee2
SHA256

06a39e32a13239675c197a284f06c3b933aa776ae71253791912bcb5164aa1b2
SHA512

5068eaa5466da4fde0bb5630dd6a0b42727a221d347894b35eebe7b57a4c35fc75c6a309737ec2d94a8214f4e9b2ff3efc8c7958e99de1c72adea5cc0a3b6fc2
SSDEEP

98304:QTEBexx5q1sXQc9NsFzd2aNpS/zoJcXGc5kXINYxNH:gtXQlzrpS/zfkX

Score

3^/10

Malware Config

Signatures

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
2084	Folio-854500047700.exe

C:\Users\Admin\AppData\Local\Temp\Folio-854500047700.exe
"C:\Users\Admin\AppData\Local\Temp\Folio-854500047700.exe"
1⤵
- Suspicious use of SetWindowsHookEx
PID:2084

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2084-133-0x00000000013C0000-0x00000000013C1000-memory.dmp

Filesize
4KB

Download
memory/2084-134-0x0000000000400000-0x0000000000C31000-memory.dmp

Filesize
8.2MB

Download
memory/2084-135-0x00000000013C0000-0x00000000013C1000-memory.dmp

Filesize
4KB

Download