e3026e2bd11e4d1f35c49a32bdc24d1b29dd62394d68c51361f590ff7886e091 | Triage

Analysis

max time kernel
149s
max time network
156s
platform
windows10-2004_x64
resource
win10v2004-20230915-en
resource tags

arch:x64arch:x86image:win10v2004-20230915-enlocale:en-usos:windows10-2004-x64system
submitted
03/10/2023, 16:50

Sharing

Report Analysis Logs

General

Target

Tools/HotkeyP/spy.exe
Size

20KB
MD5

f8b82d9eaf3abc3379bb37e119ef55f6
SHA1

e0d04d3d8f276522a43cadaf0f3bbe7d2407898f
SHA256

9443c379cfa94f264473f2bb44e2e7d10543c27baccd303532e08f966ec0963e
SHA512

99329df75f96149973d1f73654c43572db447d659d73ade7913a96df92eb1a25f6c488e445a085571e1f6f20dfc87ab990595fd5c3b0658a85b9a4ceaedb70b9
SSDEEP

192:ZzvaLO7BeH4Iw2b69bTHz9zlD3AmM412PBkP1oynMVMc2:JaLrH4D9bTT9BDHEc1fc2

Score

1^/10

Malware Config

Signatures

Suspicious use of SetWindowsHookEx 4 IoCs

pid	Process
1420	spy.exe
1420	spy.exe
2288	hook64.exe
2288	hook64.exe

Suspicious use of WriteProcessMemory 2 IoCs

description	pid	Process	procid_target
PID 1420 wrote to memory of 2288	1420	spy.exe	85
PID 1420 wrote to memory of 2288	1420	spy.exe	85

C:\Users\Admin\AppData\Local\Temp\Tools\HotkeyP\spy.exe
"C:\Users\Admin\AppData\Local\Temp\Tools\HotkeyP\spy.exe"
1⤵
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1420
- C:\Users\Admin\AppData\Local\Temp\Tools\HotkeyP\hook64.exe
  hook64.exe -s
  2⤵
  - Suspicious use of SetWindowsHookEx
  PID:2288

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads