ee31f2577fdddbe62d2161028c8c103c33d6725c36f601e3e785cb01ba350534

Analysis

max time kernel
119s
max time network
124s
platform
windows7_x64
resource
win7-20230712-en
resource tags

arch:x64arch:x86image:win7-20230712-enlocale:en-usos:windows7-x64system
submitted
15/08/2023, 07:14

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

陈瑜-广西/陈瑜 .exe
Size

160KB
MD5

3d0d2c358dab0128baad6087f730576e
SHA1

2b3efc5f663c1bd12cf5ab4b4fa74c63917cbcba
SHA256

ce97d204315dc330a2a817c59fc63db66591567b0dd141d094ebd1ff346031c9
SHA512

d8ec79745c0fcc3c8b71dfed482a289c2c2c7dee1e3f2220cdd5d9b29754289958cb1e87fb292a611c48176d5d4a0ced090bacd3c048046e74cde8e70c63ddd1
SSDEEP

1536:A1LqlA26Dcet3fubej6jF7/qYeN3wVZh:kLqyvh3fABjFwwXh

Score

3^/10

Malware Config

Signatures

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
1744	陈瑜 .exe

C:\Users\Admin\AppData\Local\Temp\陈瑜-广西\陈瑜 .exe
"C:\Users\Admin\AppData\Local\Temp\陈瑜-广西\陈瑜 .exe"
1⤵
- Suspicious use of SetWindowsHookEx
PID:1744

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1744-53-0x0000000000400000-0x0000000000423000-memory.dmp

Filesize
140KB

Download
memory/1744-56-0x0000000000400000-0x0000000000423000-memory.dmp

Filesize
140KB

Download