3cf50e28f0b5f7b930858f2de56fab4f5d0ed9fef69aa4942e6c34dcbec5e165

Analysis

max time kernel
139s
max time network
146s
platform
windows10-2004_x64
resource
win10v2004-20231023-en
resource tags

arch:x64arch:x86image:win10v2004-20231023-enlocale:en-usos:windows10-2004-x64system
submitted
16/11/2023, 01:50

Target

3cf50e28f0b5f7b930858f2de56fab4f5d0ed9fef69aa4942e6c34dcbec5e165.exe
Size

440KB
MD5

8a1e091a59f7fb04f89ae95a57a6080b
SHA1

31be7396c26c2f81c2f0b13888d33045bc9cad58
SHA256

3cf50e28f0b5f7b930858f2de56fab4f5d0ed9fef69aa4942e6c34dcbec5e165
SHA512

f0acde9b12b0c9da6a89df6f1fcaae13d76b11379f0b0879272a2a25f149e7935f23dc4a052431be0493b1310781988235d406c223df2d782dfe2d8fc89fbd22
SSDEEP

6144:Zj231+m8YfHOQuiMgAc19iMM+qk9PO502FSiNe98gWNlPTGQQm6agrdgZp3X/jct:hqIm8YfH3uiec19fH0wKNtTirdg7Y

Score

3^/10

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
4484	3cf50e28f0b5f7b930858f2de56fab4f5d0ed9fef69aa4942e6c34dcbec5e165.exe
4484	3cf50e28f0b5f7b930858f2de56fab4f5d0ed9fef69aa4942e6c34dcbec5e165.exe

C:\Users\Admin\AppData\Local\Temp\3cf50e28f0b5f7b930858f2de56fab4f5d0ed9fef69aa4942e6c34dcbec5e165.exe
"C:\Users\Admin\AppData\Local\Temp\3cf50e28f0b5f7b930858f2de56fab4f5d0ed9fef69aa4942e6c34dcbec5e165.exe"
1⤵
- Suspicious use of SetWindowsHookEx
PID:4484

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

memory/4484-0-0x0000000000400000-0x0000000000476000-memory.dmp

Filesize
472KB

Download