4af668a13ee208b82fa86d216971bf49b502d49fdc179b513b1b84862b580438

Analysis

max time kernel
142s
max time network
153s
platform
windows10-2004_x64
resource
win10v2004-20230915-en
resource tags

arch:x64arch:x86image:win10v2004-20230915-enlocale:en-usos:windows10-2004-x64system
submitted
12/10/2023, 03:22

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

4af668a13ee208b82fa86d216971bf49b502d49fdc179b513b1b84862b580438.exe
Size

13.2MB
MD5

72fae45267014ae94a1cbf03c9a92422
SHA1

e9b40d294da7584849ea742049cd4a38c6cb8f62
SHA256

4af668a13ee208b82fa86d216971bf49b502d49fdc179b513b1b84862b580438
SHA512

79962bdbf40a91ab9e928d3790a867fbdd8b73c8d231048806c1c6e4de06339565492260082fceb69d0ceda16a064026ed9e42c9d4f5348fe92e99294e03ab36
SSDEEP

393216:a3hpJ60EoIs95b5iLUS5iADzEqLJLRixbT:mV7R395b5IUcie7RixP

Score

3^/10

Malware Config

Signatures

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious use of SetWindowsHookEx 4 IoCs

pid	Process
1128	4af668a13ee208b82fa86d216971bf49b502d49fdc179b513b1b84862b580438.exe
1128	4af668a13ee208b82fa86d216971bf49b502d49fdc179b513b1b84862b580438.exe
1128	4af668a13ee208b82fa86d216971bf49b502d49fdc179b513b1b84862b580438.exe
1128	4af668a13ee208b82fa86d216971bf49b502d49fdc179b513b1b84862b580438.exe

C:\Users\Admin\AppData\Local\Temp\4af668a13ee208b82fa86d216971bf49b502d49fdc179b513b1b84862b580438.exe
"C:\Users\Admin\AppData\Local\Temp\4af668a13ee208b82fa86d216971bf49b502d49fdc179b513b1b84862b580438.exe"
1⤵
- Suspicious use of SetWindowsHookEx
PID:1128

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\4af668a13ee208b82fa86d216971bf49b502d49fdc179b513b1b84862b580438.exepack.tmp

Filesize
2KB

MD5
307df4e49a9619ae7d6e987e6919b0f7

SHA1
4279a4643b46a4670d2960dde15130ba563cdd5d

SHA256
a5b076bc53e2acd5a8af9fbc627e5f860373d2a830c26da154039d339d3562ac

SHA512
f2eadc101cb36704fcf4a992be247b9223e12a0d43bacf8e5c129d5bf5837652a062dedede565b337e10e342ed72da76c7045e78dc6fffcac4971afd44bdd9ad

Download Submit
C:\Users\Admin\AppData\Local\Temp\7ad0cf517411880a4353da07a95f0ba3.ini

Filesize
1KB

MD5
148a2220960514cedfa8afa128790427

SHA1
cb81e8e702b7dce0c1153714e3a19be796801d3c

SHA256
af6d94d8e4e215af03c8c7afe6fa640604e49557bca9c0c0f4f3ea59df9468a6

SHA512
89f968c2eb3f0f0ccede8f22ca1872a59d24cf475e1a71e419d542dab7437ef5f99f67d9ebdaa9fb81ee43af12eb704b91ca39ba16819496db4d737e2c93ca2a

Download Submit
C:\Users\Admin\AppData\Local\Temp\7ad0cf517411880a4353da07a95f0ba3A.ini

Filesize
1KB

MD5
1ea882b96671da8b0422f5a1bbe9dff4

SHA1
34f52cc10548314178b8c1e88df2cc9b8f1fa4c0

SHA256
6f1868be9ed50c7002b752762997882e3a5b8b7a6b55d1c7f1935c7b33833090

SHA512
d20634364e18ed5913d3848e29286dd04bf0fa555b0ffc2868598bcd9438276c2c089945f8219384d951e858a66a94a142355cd87bcafaaf10fc8d2090f141cc

Download Submit
memory/1128-0-0x0000000000400000-0x0000000001ECA000-memory.dmp

Filesize
26.8MB

Download
memory/1128-1-0x00000000024A0000-0x00000000024A3000-memory.dmp

Filesize
12KB

Download
memory/1128-2-0x0000000000400000-0x0000000001ECA000-memory.dmp

Filesize
26.8MB

Download
memory/1128-5-0x0000000050000000-0x0000000050109000-memory.dmp

Filesize
1.0MB

Download
memory/1128-340-0x0000000000400000-0x0000000001ECA000-memory.dmp

Filesize
26.8MB

Download
memory/1128-341-0x00000000024A0000-0x00000000024A3000-memory.dmp

Filesize
12KB

Download
memory/1128-350-0x0000000050000000-0x0000000050109000-memory.dmp

Filesize
1.0MB

Download