c9281f71ce3ea2137df09813308a48eebfc82a9f803a824a0678f91cd78b83df

Analysis

max time kernel
131s
max time network
153s
platform
windows10-2004_x64
resource
win10v2004-20231023-en
resource tags

arch:x64arch:x86image:win10v2004-20231023-enlocale:en-usos:windows10-2004-x64system
submitted
18/11/2023, 01:45

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

c9281f71ce3ea2137df09813308a48eebfc82a9f803a824a0678f91cd78b83df.exe
Size

326KB
MD5

016872478ae282dc8d11892e951655d2
SHA1

d99dca45c5fa82ed09af3442c22c64fd324d1842
SHA256

c9281f71ce3ea2137df09813308a48eebfc82a9f803a824a0678f91cd78b83df
SHA512

d142278316049e169f99216a9ed4c5469e8ebb85ce97bafcdf14fac171051394ba01ca4fa8122bcc8345d158de795083df6f56e211a77ec040df6d896748e6c7
SSDEEP

6144:lZyxu1qvUw2oE6zs0nnExLheIuLVYtCj3h:qxqhwi6zFnSoOtCl

Score

3^/10

Malware Config

Signatures

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
1804	c9281f71ce3ea2137df09813308a48eebfc82a9f803a824a0678f91cd78b83df.exe

Suspicious use of SendNotifyMessage 1 IoCs

pid	Process
1804	c9281f71ce3ea2137df09813308a48eebfc82a9f803a824a0678f91cd78b83df.exe

Suspicious use of SetWindowsHookEx 3 IoCs

pid	Process
1804	c9281f71ce3ea2137df09813308a48eebfc82a9f803a824a0678f91cd78b83df.exe
1804	c9281f71ce3ea2137df09813308a48eebfc82a9f803a824a0678f91cd78b83df.exe
1804	c9281f71ce3ea2137df09813308a48eebfc82a9f803a824a0678f91cd78b83df.exe

C:\Users\Admin\AppData\Local\Temp\c9281f71ce3ea2137df09813308a48eebfc82a9f803a824a0678f91cd78b83df.exe
"C:\Users\Admin\AppData\Local\Temp\c9281f71ce3ea2137df09813308a48eebfc82a9f803a824a0678f91cd78b83df.exe"
1⤵
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of SetWindowsHookEx
PID:1804

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\offAD1.htm

Filesize
928B

MD5
da7c01176cc0a2feeb7f10337ec850d7

SHA1
ae459cf4d38f6aacba69926cebd0ebf6e5be8249

SHA256
69f6d00c8713302bffee0f2e8976f9f445ec39252578967e513a6c9a64d4f232

SHA512
3e42537b07eb77fcad74266e0aaba7d4bbb20ca2676e596dc0362d0aca1eb8bbaa58a499bfcc49c0e7a8ad37ec193a28c89ff2ddf0bec380212e7d7eeb887d0a

Download Submit
memory/1804-0-0x0000000000400000-0x0000000000458000-memory.dmp

Filesize
352KB

Download
memory/1804-13-0x0000000000400000-0x0000000000458000-memory.dmp

Filesize
352KB

Download