6504d3d732a500bc1ee7cf81f2d00cefccaebed175cc1eb1df13d82d9b83e5d5

Analysis

max time kernel
117s
max time network
120s
platform
windows7_x64
resource
win7-20231023-en
resource tags

arch:x64arch:x86image:win7-20231023-enlocale:en-usos:windows7-x64system
submitted
13-11-2023 11:48

Target

6504d3d732a500bc1ee7cf81f2d00cefccaebed175cc1eb1df13d82d9b83e5d5.exe
Size

152KB
MD5

b59b8b60633f4477d0160dfaddfa6899
SHA1

6702a138fb55ea3e15ab8a030f499925e4f02c1d
SHA256

6504d3d732a500bc1ee7cf81f2d00cefccaebed175cc1eb1df13d82d9b83e5d5
SHA512

f5e8e4f4a0c22a5bfb2b406f6662236e11693a1066f2e4937a8b8389d22735b683287b8d75b0eac1dc8e04667fa8864e24682065ca8944e9ae16be492b93a411
SSDEEP

1536:QVU7YpxuKobIY6TgTJhJh5tgpIy4TzfOMM/BQkZQA:QuoxQbIY6TgTKtr1

Score

3^/10

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious use of SetWindowsHookEx 3 IoCs

pid	Process
2196	6504d3d732a500bc1ee7cf81f2d00cefccaebed175cc1eb1df13d82d9b83e5d5.exe
2196	6504d3d732a500bc1ee7cf81f2d00cefccaebed175cc1eb1df13d82d9b83e5d5.exe
2196	6504d3d732a500bc1ee7cf81f2d00cefccaebed175cc1eb1df13d82d9b83e5d5.exe

C:\Users\Admin\AppData\Local\Temp\6504d3d732a500bc1ee7cf81f2d00cefccaebed175cc1eb1df13d82d9b83e5d5.exe
"C:\Users\Admin\AppData\Local\Temp\6504d3d732a500bc1ee7cf81f2d00cefccaebed175cc1eb1df13d82d9b83e5d5.exe"
1⤵
- Suspicious use of SetWindowsHookEx
PID:2196

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact