42e6fab8e2a29b0794b789af8f4602dfef0de9c6141374055845367859ba4ab7

Analysis

max time kernel
119s
max time network
119s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
24/12/2023, 18:03

Target

0a51f6decb3d909026e2253511381c99.exe
Size

159KB
MD5

0a51f6decb3d909026e2253511381c99
SHA1

32995bd91331a9aab0dfe828d89570d6cab2aa65
SHA256

42e6fab8e2a29b0794b789af8f4602dfef0de9c6141374055845367859ba4ab7
SHA512

32eb83ff2463089a0b2939a493f0b4180912020c1a6d59c7e9a7647ea7be59d610cc10c0456742d371538185c1c3f21489ccf7eeca6f5065fe34766c2770533e
SSDEEP

3072:ife7gZOzv+55ROnYb5YAjOGImN8nvJ4yvKjylQNVVwrlVjKTz:D2HRyYVfjCGAvJ4gHweXjmz

Score

3^/10

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
3028	0a51f6decb3d909026e2253511381c99.exe

C:\Users\Admin\AppData\Local\Temp\0a51f6decb3d909026e2253511381c99.exe
"C:\Users\Admin\AppData\Local\Temp\0a51f6decb3d909026e2253511381c99.exe"
1⤵
- Suspicious use of SetWindowsHookEx
PID:3028

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact