4f8878b333c78176b2964a7c6daf34a2d8cf60c03f07e1c12750c013725ac630

Analysis

max time kernel
141s
max time network
124s
platform
windows7_x64
resource
win7-20231023-en
resource tags

arch:x64arch:x86image:win7-20231023-enlocale:en-usos:windows7-x64system
submitted
25/11/2023, 10:04

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

4f8878b333c78176b2964a7c6daf34a2d8cf60c03f07e1c12750c013725ac630.exe
Size

179KB
MD5

95644ac606a87676a2dd44c0e8a43843
SHA1

60ac148ab6da1a54050eaea6d3318f1e097c075a
SHA256

4f8878b333c78176b2964a7c6daf34a2d8cf60c03f07e1c12750c013725ac630
SHA512

95ce0d2c77dee5df8dc74d219dac497f961b2607a48b5f3a5f0044d1ff70bcd0e145ade899509d031be08b94dbe326306e91f56ebb2268465b2718884690e837
SSDEEP

3072:jovpE1awCgf2NlEjDEgZ8atky4omaR8FLgKXD2ot4VALcAQmJnGnoutX2GqTpB9c:jomawnOyMM63oj2FLFxtAKcgGnoSXk

Score

6^/10

Malware Config

Signatures

Enumerates connected drives 3 TTPs 2 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\D:	4f8878b333c78176b2964a7c6daf34a2d8cf60c03f07e1c12750c013725ac630.exe
File opened (read-only)	\??\F:	4f8878b333c78176b2964a7c6daf34a2d8cf60c03f07e1c12750c013725ac630.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
2880	4f8878b333c78176b2964a7c6daf34a2d8cf60c03f07e1c12750c013725ac630.exe

C:\Users\Admin\AppData\Local\Temp\4f8878b333c78176b2964a7c6daf34a2d8cf60c03f07e1c12750c013725ac630.exe
"C:\Users\Admin\AppData\Local\Temp\4f8878b333c78176b2964a7c6daf34a2d8cf60c03f07e1c12750c013725ac630.exe"
1⤵
- Enumerates connected drives
- Suspicious use of SetWindowsHookEx
PID:2880

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2880-0-0x0000000000400000-0x00000000004E0000-memory.dmp

Filesize
896KB

Download
memory/2880-3-0x0000000000400000-0x00000000004E0000-memory.dmp

Filesize
896KB

Download