157eb0b61b30a9664e8d0c76a97b914098bedcbb26b963463eb743d0def81f41

Analysis

max time kernel
118s
max time network
124s
platform
windows7_x64
resource
win7-20230831-en
resource tags

arch:x64arch:x86image:win7-20230831-enlocale:en-usos:windows7-x64system
submitted
03-09-2023 11:01

Target

2023-08-22_9cf258b8f950aec7a98ce2d249a25c43_mafia_JC.exe
Size

21.9MB
MD5

9cf258b8f950aec7a98ce2d249a25c43
SHA1

8939b30ea153e2e26add03a80b38a15fd4716229
SHA256

157eb0b61b30a9664e8d0c76a97b914098bedcbb26b963463eb743d0def81f41
SHA512

f15179a1973a749d0ddbc3393f649b28299791e4d766e42b0b28ba4ead0078b6395eda89a39368f9de5804aca9a4051c197291504e69353ee30c60c6870d842f
SSDEEP

393216:agfcQLnX7Ark1+spf+HKn/BUuF31crMHvsPPlEIeql1:agEQLXBhh+HKn/BUuF31cAHqb1

Score

3^/10

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
1692	2023-08-22_9cf258b8f950aec7a98ce2d249a25c43_mafia_JC.exe
1692	2023-08-22_9cf258b8f950aec7a98ce2d249a25c43_mafia_JC.exe

C:\Users\Admin\AppData\Local\Temp\2023-08-22_9cf258b8f950aec7a98ce2d249a25c43_mafia_JC.exe
"C:\Users\Admin\AppData\Local\Temp\2023-08-22_9cf258b8f950aec7a98ce2d249a25c43_mafia_JC.exe"
1⤵
- Suspicious use of SetWindowsHookEx
PID:1692

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact