ae77f45ea76747f1d312a6e2757333e81b40fcee731f300afc324214960fb16e

Analysis

max time kernel
75s
max time network
60s
platform
windows7_x64
resource
win7-20230220-en
resource tags

arch:x64arch:x86image:win7-20230220-enlocale:en-usos:windows7-x64system
submitted
19-06-2023 19:14

Target

ae77f45ea76747f1d312a6e2757333e81b40fcee731f300afc324214960fb16e.exe
Size

4.2MB
MD5

a93a2a417c412aef9bae258e27a6263e
SHA1

bb212841e4478798110795bf1389e94a8a70094a
SHA256

ae77f45ea76747f1d312a6e2757333e81b40fcee731f300afc324214960fb16e
SHA512

5cbc7d2d89534a8f629df80c49d5b1f3a46a24703636b7f07f31717081b5c5eae085bf0e68b18a2028f928ffdbb1314e83d23ffcdd82faf02d9c536fe3203236
SSDEEP

98304:vrEaB7+7NB8dh8MPXAKkc8UrxuYYjZikgbxVEY6yuG:vrESaJsh5PQUFu5ifbcWuG

Score

3^/10

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious behavior: EnumeratesProcesses 2 IoCs

Processes:

ae77f45ea76747f1d312a6e2757333e81b40fcee731f300afc324214960fb16e.exe

pid	process
1232	ae77f45ea76747f1d312a6e2757333e81b40fcee731f300afc324214960fb16e.exe
1232	ae77f45ea76747f1d312a6e2757333e81b40fcee731f300afc324214960fb16e.exe

Suspicious use of SetWindowsHookEx 3 IoCs

Processes:

ae77f45ea76747f1d312a6e2757333e81b40fcee731f300afc324214960fb16e.exe

pid	process
1232	ae77f45ea76747f1d312a6e2757333e81b40fcee731f300afc324214960fb16e.exe
1232	ae77f45ea76747f1d312a6e2757333e81b40fcee731f300afc324214960fb16e.exe
1232	ae77f45ea76747f1d312a6e2757333e81b40fcee731f300afc324214960fb16e.exe

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

memory/1232-55-0x0000000000400000-0x0000000001592000-memory.dmp

Filesize
17.6MB

Download
memory/1232-56-0x0000000000400000-0x0000000001592000-memory.dmp

Filesize
17.6MB

Download
memory/1232-57-0x0000000000400000-0x0000000001592000-memory.dmp

Filesize
17.6MB

Download
memory/1232-58-0x0000000000400000-0x0000000001592000-memory.dmp

Filesize
17.6MB

Download
memory/1232-59-0x0000000000220000-0x0000000000221000-memory.dmp

Filesize
4KB

Download
memory/1232-62-0x0000000000400000-0x0000000001592000-memory.dmp

Filesize
17.6MB

Download
memory/1232-65-0x0000000000400000-0x0000000001592000-memory.dmp

Filesize
17.6MB

Download
memory/1232-67-0x0000000000220000-0x0000000000221000-memory.dmp

Filesize
4KB

Download
memory/1232-73-0x0000000000400000-0x0000000001592000-memory.dmp

Filesize
17.6MB

Download
memory/1232-74-0x0000000000400000-0x0000000001592000-memory.dmp

Filesize
17.6MB

Download