5a47e926fe5c0a94094fb7fbd3fc78a74c273038ffdd259c67b97867e6590369

Analysis

max time kernel
131s
max time network
135s
platform
windows10-2004_x64
resource
win10v2004-20231215-en
resource tags

arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
submitted
24/12/2023, 23:59

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

1b498a3c15e4f9787d11d27fdf110f42.exe
Size

156KB
MD5

1b498a3c15e4f9787d11d27fdf110f42
SHA1

38769b4f17a377f7f984888afea4caacbc7a51f3
SHA256

5a47e926fe5c0a94094fb7fbd3fc78a74c273038ffdd259c67b97867e6590369
SHA512

773611b0da4f709e7a9f6a5d4a80564efbd94d9e89d2034acdc9e3657be519736e3090def8e86fee61fa193f3816419cf5e7500883084b0abec4efebfa207df9
SSDEEP

3072:PvkHeR+EF0B9eKwRsKw1QQTahuP3fAtP9jwAGjcnZA:PcHeR+Yy9eKesDQQTsuQNtC

Score

5^/10

Malware Config

Signatures

Drops file in System32 directory 1 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SysWOW64\s.exe	1b498a3c15e4f9787d11d27fdf110f42.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
4036	1b498a3c15e4f9787d11d27fdf110f42.exe

C:\Users\Admin\AppData\Local\Temp\1b498a3c15e4f9787d11d27fdf110f42.exe
"C:\Users\Admin\AppData\Local\Temp\1b498a3c15e4f9787d11d27fdf110f42.exe"
1⤵
- Drops file in System32 directory
- Suspicious use of SetWindowsHookEx
PID:4036

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\e4l03bcc\tmp.exe

Filesize
68KB

MD5
442b0d3cf774362458b67ca3993b066e

SHA1
3bd18a3c642db4a2cf25652b298de285aceee172

SHA256
368901e6a5b4315d95daf789e87a0f96e6927b2676464aacd6186a96068a757e

SHA512
d2e66cd9cf18769d88e2d431685aa3a6914c5acc4b534156d65d680a2ce17125a9e956bccdeab2037f66bc35df2da79beac322269f4cf63c82baab54bb856924

Download Submit