b8c2b79c1759a50353ba124c5bb7240b5eec5b433af1979ceb1ab2ccfb5b77ab

Analysis

max time kernel
141s
max time network
146s
platform
windows10-2004_x64
resource
win10v2004-20230703-en
resource tags

arch:x64arch:x86image:win10v2004-20230703-enlocale:en-usos:windows10-2004-x64system
submitted
29/08/2023, 22:04

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

b8c2b79c1759a50353ba124c5bb7240b5eec5b433af1979ceb1ab2ccfb5b77ab.exe
Size

11.6MB
MD5

61fce3b4d45f4dd3148bd5cf653f6e6a
SHA1

65654cc33a5b53f210de834adc73eb2dfb8e745f
SHA256

b8c2b79c1759a50353ba124c5bb7240b5eec5b433af1979ceb1ab2ccfb5b77ab
SHA512

757b2cdca038ca6f2986eeae62de6e3e30796074f8bfaee4c5771e75caa9971b955898a2b003032de77dff74e94506ab7f97348d76bc4475e0499d7facc77a0e
SSDEEP

196608:x1Artg5QeoEtzqQ0C/8h3oTs79LQz8dEFCMezJ6hVMUopMQahLl5EdKFbyb+X0ME:xirG5QeouzlZ/8h30TZTFVMUo+JuoX0N

Score

3^/10

Malware Config

Signatures

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious use of SetWindowsHookEx 4 IoCs

pid	Process
4628	b8c2b79c1759a50353ba124c5bb7240b5eec5b433af1979ceb1ab2ccfb5b77ab.exe
4628	b8c2b79c1759a50353ba124c5bb7240b5eec5b433af1979ceb1ab2ccfb5b77ab.exe
4628	b8c2b79c1759a50353ba124c5bb7240b5eec5b433af1979ceb1ab2ccfb5b77ab.exe
4628	b8c2b79c1759a50353ba124c5bb7240b5eec5b433af1979ceb1ab2ccfb5b77ab.exe

C:\Users\Admin\AppData\Local\Temp\b8c2b79c1759a50353ba124c5bb7240b5eec5b433af1979ceb1ab2ccfb5b77ab.exe
"C:\Users\Admin\AppData\Local\Temp\b8c2b79c1759a50353ba124c5bb7240b5eec5b433af1979ceb1ab2ccfb5b77ab.exe"
1⤵
- Suspicious use of SetWindowsHookEx
PID:4628

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\1cd9e62d128451d63bc88f2f2bff481a.ini

Filesize
1KB

MD5
32b50b9c4062c85da1f0f7f46d389042

SHA1
e66eba04e061dfdb364ca85cbe58678cc40eac03

SHA256
de8938fccf6bfa7b38aeb07cbf23981431878439af87a0c99a3837f53798d110

SHA512
0e4c058663716e0a6d67f75a83a4cddcb939ce9cc973152dcc18af82d221ebd94d3981d8942867f43d7667c719779e00f5722fe3649023231397f2bb9e7f4fac

Download Submit
C:\Users\Admin\AppData\Local\Temp\1cd9e62d128451d63bc88f2f2bff481aA.ini

Filesize
1KB

MD5
6477f9e7a7880f4c2d650d7321cdb18c

SHA1
5b472f054fae0251d2ccae816d4400840a1a3b9e

SHA256
7ded08d7288bb94cc47e3bf4ce134644b42092cce6b57193c1a8831d79a33596

SHA512
df801129794d9bd21b4fcf15eb39bd2a1b450f99b0288881c387c395ae4b3b96c84f092ecfb7bb0485b80deab57f504152b698ab68ede8183e5d037b7fd94bc9

Download Submit
C:\Users\Admin\AppData\Local\Temp\b8c2b79c1759a50353ba124c5bb7240b5eec5b433af1979ceb1ab2ccfb5b77ab.exepack.tmp

Filesize
2KB

MD5
88f2768357b25449d7bb150d270c3da7

SHA1
5c302fb1c4e72270a93c3546f321e1b1d14571b7

SHA256
f7b285b0cb15ca844153b3cfa73e98457e0be7471803c1f5642943348a8bad9f

SHA512
967b8147f5ab196d3028623a302c7ac71e90f2134946232026a832d4b9429eb8b8a4c43a7559d406da58da0c1569cf02f2429be04c4583d7dbadf67197820697

Download Submit
memory/4628-0-0x0000000000400000-0x0000000001EA1000-memory.dmp

Filesize
26.6MB

Download
memory/4628-1-0x0000000002610000-0x0000000002613000-memory.dmp

Filesize
12KB

Download
memory/4628-2-0x0000000000400000-0x0000000001EA1000-memory.dmp

Filesize
26.6MB

Download
memory/4628-5-0x0000000050000000-0x0000000050109000-memory.dmp

Filesize
1.0MB

Download
memory/4628-359-0x0000000000400000-0x0000000001EA1000-memory.dmp

Filesize
26.6MB

Download
memory/4628-361-0x0000000002610000-0x0000000002613000-memory.dmp

Filesize
12KB

Download
memory/4628-363-0x0000000050000000-0x0000000050109000-memory.dmp

Filesize
1.0MB

Download