803b2994caadaf77d62e7bf1ca6a50f1907549cca6201d0df32e8e674ee7728a

Analysis

max time kernel
3s
max time network
136s
platform
windows10-2004_x64
resource
win10v2004-20231215-en
resource tags

arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
submitted
25/12/2023, 22:29

Target

403d7c22f8b11ce4f8b2bd12530efb19.exe
Size

176KB
MD5

403d7c22f8b11ce4f8b2bd12530efb19
SHA1

c13cb4973c9080f090fc8e25b2f214336b3fad84
SHA256

803b2994caadaf77d62e7bf1ca6a50f1907549cca6201d0df32e8e674ee7728a
SHA512

e565d03c0c896bad082c7831900d68299a5905703a0c67c51be0890b335432625090efd88a1f1fb1f211f4613d7489532ac5a17cb0e0ffdb9515f8b5e07d696a
SSDEEP

3072:DBulNB57EoiO8S9aCWKnvmb7/D26BXbBD8R4FpjIyc4j+agdLfED0Co0beLy9A5l:DB8fBQKnvmb7/D26BLBD8R4FpjIyc4j4

Score

3^/10

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
3912	403d7c22f8b11ce4f8b2bd12530efb19.exe

C:\Users\Admin\AppData\Local\Temp\403d7c22f8b11ce4f8b2bd12530efb19.exe
"C:\Users\Admin\AppData\Local\Temp\403d7c22f8b11ce4f8b2bd12530efb19.exe"
1⤵
- Suspicious use of SetWindowsHookEx
PID:3912
- C:\Users\Admin\kaouco.exe
  "C:\Users\Admin\kaouco.exe"
  2⤵
  PID:4364

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

C:\Users\Admin\kaouco.exe

Filesize
20KB

MD5
1ad34b933f6d880560e74954ae03a1bf

SHA1
b31a0b9d4f3eff2414b10b04e780469771f9969d

SHA256
ea82466f33650bb8e3896c8c5d1760a2bae05cd32fa49a0e63d9fbac0053e177

SHA512
e4d755162724030a526e6a55923fd681330fc3727776fb4ca9fe312632c9f04ac129bb524deedcc29e4fddbf82713644b8db5004ae93ad90f52f3b9a9598da49

Download Submit
C:\Users\Admin\kaouco.exe

Filesize
30KB

MD5
f467f6e4b740185a2e6b7c6ef1f9d33a

SHA1
30468c6495f24a75ff0270ee70291bcb22b087c9

SHA256
e5bb52508a99d01d28da566b90eaad85964bb12808ba0637eb8ad8f7bf28c443

SHA512
c72accc6b76c7096f41ec2e081d2df7a7f987d5b1709dbf897d27ccd46c5a90f8f16b221ecb1bd39f7cb13aae25dd7baf135bfe2d15d09da218b69cb990d15fd

Download Submit
C:\Users\Admin\kaouco.exe

Filesize
9KB

MD5
409d7dac615b9dcaff61ac9c56a80a5a

SHA1
02ad0fd0579ff099fd9b975409be52c889af6272

SHA256
62cc55c6f65149f7974755ed3b1e407f7ae74df0a44871102f2cbf2beafc7e5b

SHA512
7d76d335303627ada488a4601e2e21ea153db1f4453820a5f74cfb92deb3fddb205a33c1a8a56ca6f2c0cdafbd61eaa915078e4da8391b5902bdfb06e4d2eab6

Download Submit