b5bdd2f2588f92c5b375ea0670d0c4a329681773163b3ca9be224c5e2d3c8a66

Analysis

max time kernel
7s
max time network
109s
platform
windows10-2004_x64
resource
win10v2004-20231215-en
resource tags

arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
submitted
25/12/2023, 02:31

Target

0011a2fe0c22765006d0d3d3a27bbcc9.exe
Size

172KB
MD5

0011a2fe0c22765006d0d3d3a27bbcc9
SHA1

7419d9c0341158d6f48420991162d22f87836f92
SHA256

b5bdd2f2588f92c5b375ea0670d0c4a329681773163b3ca9be224c5e2d3c8a66
SHA512

136ca8a8f1bb4e61c3b0666602021e8e1007ec3ed936f30577cef9854927e920cb1e90f1788ee90aa3fe7fad27f3eeecd0f4992f08427b88dc4f21d3abf81531
SSDEEP

3072:dIJ/t18k5gq6Knvmb7/D26hjCWad38RQFyjwGBEWNDsn6slPct+hiBuAZd+q:2/tOtKnvmb7/D26heWad38RQFyjwGWo9

Score

3^/10

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
3228	0011a2fe0c22765006d0d3d3a27bbcc9.exe

C:\Users\Admin\AppData\Local\Temp\0011a2fe0c22765006d0d3d3a27bbcc9.exe
"C:\Users\Admin\AppData\Local\Temp\0011a2fe0c22765006d0d3d3a27bbcc9.exe"
1⤵
- Suspicious use of SetWindowsHookEx
PID:3228
- C:\Users\Admin\ydxuay.exe
  "C:\Users\Admin\ydxuay.exe"
  2⤵
  PID:1636

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

C:\Users\Admin\ydxuay.exe

Filesize
37KB

MD5
3fea9dc5a4b076c4915e9545dd2e706b

SHA1
d4a11a9a2bbcbd776dfde3b4e73089cdedd96c13

SHA256
615e9c9ae55c9ee41603ffe738eebe7113129fe53efad057f5369ddb8ac5ad99

SHA512
05223ccb01f6934e7a63d74d1b7f789aedc17db91466a1f0a7114b51de7acb417fa1f91807375aa6f0fac5f3156b5f967a9ce36894c944b7a735b47f7256c3e5

Download Submit
C:\Users\Admin\ydxuay.exe

Filesize
17KB

MD5
df883ebf27f5adda8c60cf65ca38a06e

SHA1
cd7d6f079c0647013260f7d414b84e423e7fa069

SHA256
bb49120dffa7cc286fb4eb56db9dcf0f5f11591e01cc0822f8e8fdb6fd57c1fa

SHA512
27b4ce9294727907c58f4897034647818e2bf0be60e21f5dbfeed137f7600b4e7af5583420f421961825dcb7ebe493f3e9e99dbe5f06a1366bf676b42899d7f8

Download Submit
C:\Users\Admin\ydxuay.exe

Filesize
18KB

MD5
e9a32674c3b682de914f2b02cc5fb3c0

SHA1
6c75cf944845fa6c59aa59e947392a80e78b94b4

SHA256
83087a1361b0ddcbfd8c6c0145092a45d67be36ac2d7daffff7a753888e2e270

SHA512
c19a8648ce8a01723a1f4aa73d94108b262be01107e4813af6ec568dbcb24f8d423208bb5f65ffaa269a44d490478df424f238733869cf46d0c62b003e623953

Download Submit