ad829add062025c15dc208ed305a34f67e8998687f2041da2ae43702d2fba2b4

Analysis

max time kernel
121s
max time network
125s
platform
windows7_x64
resource
win7-20230831-en
resource tags

arch:x64arch:x86image:win7-20230831-enlocale:en-usos:windows7-x64system
submitted
13-10-2023 20:47

Target

ad829add062025c15dc208ed305a34f67e8998687f2041da2ae43702d2fba2b4.exe
Size

2.0MB
MD5

2e11f9e42845cc26bd919ae5e07ff0cf
SHA1

93bb32fa942e0b1d4b9fd76d610feeaa7b516cf5
SHA256

ad829add062025c15dc208ed305a34f67e8998687f2041da2ae43702d2fba2b4
SHA512

a2080cb25e1834f32f9e850f7a2c434e9d677d59fae842b94d138868a27d75a9b613c1860de52c82f654eb2421987692fc914bcac98482d2880bd0508f386ea5
SSDEEP

49152:jByyRAH9jerqG+6BN4x4Tahe7lRfsbl9L40anbfj94gblORMeVFopknoWs:lBGH9jerqGhN4Zhe7jfIl9k0abbuJ2e6

Score

3^/10

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
2176	ad829add062025c15dc208ed305a34f67e8998687f2041da2ae43702d2fba2b4.exe

C:\Users\Admin\AppData\Local\Temp\ad829add062025c15dc208ed305a34f67e8998687f2041da2ae43702d2fba2b4.exe
"C:\Users\Admin\AppData\Local\Temp\ad829add062025c15dc208ed305a34f67e8998687f2041da2ae43702d2fba2b4.exe"
1⤵
- Suspicious use of SetWindowsHookEx
PID:2176

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact