4a04d3d39c6e6eddc54cac4dcb33b62ef774c8c3ec436b2c8f2c7c5da6b19025

Analysis

max time kernel
142s
max time network
147s
platform
windows10-2004_x64
resource
win10v2004-20230703-en
resource tags

arch:x64arch:x86image:win10v2004-20230703-enlocale:en-usos:windows10-2004-x64system
submitted
16-08-2023 07:13

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

税务行政处罚事项告知书/6.exe
Size

805KB
MD5

79a72d509cf678f8a9597862dfed29ab
SHA1

c0a76aa26afa412248ba0528165e5a89df7c1c62
SHA256

27c6371c3e13d821aa0094536b65887faf9d06f0993ad83175f91b1bf89d32ad
SHA512

cbec117a9f32a77b0a6f29d72a2275fa53f81caa91d3ea1bbbc8584537911b88282f4600be4c83d32a2edb805c9057cc211e3e98a8aa3b5f1eea85612f6b6a8c
SSDEEP

12288:gpQfW2/Rsn/Uvf+PQzxhbPkQayP2K8yI6Dr9t++VV43Q/7FpRIze:ED2pFvgixh7B+Kk6Drpy3Q/Ke

Score

3^/10

Malware Config

Signatures

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
4588	6.exe
4588	6.exe

C:\Users\Admin\AppData\Local\Temp\税务行政处罚事项告知书\6.exe
"C:\Users\Admin\AppData\Local\Temp\税务行政处罚事项告知书\6.exe"
1⤵
- Suspicious use of SetWindowsHookEx
PID:4588

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/4588-133-0x0000000000400000-0x00000000005BB000-memory.dmp

Filesize
1.7MB

Download
memory/4588-134-0x0000000002310000-0x0000000002313000-memory.dmp

Filesize
12KB

Download
memory/4588-135-0x0000000000400000-0x00000000005BB000-memory.dmp

Filesize
1.7MB

Download
memory/4588-136-0x0000000002310000-0x0000000002313000-memory.dmp

Filesize
12KB

Download