e3026e2bd11e4d1f35c49a32bdc24d1b29dd62394d68c51361f590ff7886e091 | Triage

Analysis

max time kernel
122s
max time network
130s
platform
windows7_x64
resource
win7-20230831-en
resource tags

arch:x64arch:x86image:win7-20230831-enlocale:en-usos:windows7-x64system
submitted
03-10-2023 16:50

Sharing

Report Analysis Logs

General

Target

Tools/HotkeyP/spy.exe
Size

20KB
MD5

f8b82d9eaf3abc3379bb37e119ef55f6
SHA1

e0d04d3d8f276522a43cadaf0f3bbe7d2407898f
SHA256

9443c379cfa94f264473f2bb44e2e7d10543c27baccd303532e08f966ec0963e
SHA512

99329df75f96149973d1f73654c43572db447d659d73ade7913a96df92eb1a25f6c488e445a085571e1f6f20dfc87ab990595fd5c3b0658a85b9a4ceaedb70b9
SSDEEP

192:ZzvaLO7BeH4Iw2b69bTHz9zlD3AmM412PBkP1oynMVMc2:JaLrH4D9bTT9BDHEc1fc2

Score

1^/10

Malware Config

Signatures

Suspicious use of SetWindowsHookEx 4 IoCs

pid	Process
308	spy.exe
308	spy.exe
2220	hook64.exe
2220	hook64.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 308 wrote to memory of 2220	308	spy.exe	28
PID 308 wrote to memory of 2220	308	spy.exe	28
PID 308 wrote to memory of 2220	308	spy.exe	28
PID 308 wrote to memory of 2220	308	spy.exe	28

C:\Users\Admin\AppData\Local\Temp\Tools\HotkeyP\spy.exe
"C:\Users\Admin\AppData\Local\Temp\Tools\HotkeyP\spy.exe"
1⤵
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:308
- C:\Users\Admin\AppData\Local\Temp\Tools\HotkeyP\hook64.exe
  hook64.exe -s
  2⤵
  - Suspicious use of SetWindowsHookEx
  PID:2220

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads