e94e6c62ef84f1ab1f46e86c60361d70524beaa75be2938d0c92a3fa5edc8d80

Analysis

max time kernel
148s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20231215-en
resource tags

arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
submitted
25/12/2023, 04:42

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

05cc6873a99d2167315bcf37efc6d9a8.exe
Size

9KB
MD5

05cc6873a99d2167315bcf37efc6d9a8
SHA1

0310e1a40c5c0b6b1e62a50622c5fa49827acf2b
SHA256

e94e6c62ef84f1ab1f46e86c60361d70524beaa75be2938d0c92a3fa5edc8d80
SHA512

32cede8bb8305ad254bc4a4bc04bd811f338a032e445f5f72fe42336c9c7d7eb2c8d87587e8cc820a6f4faeb87760428bcd53feb2d3b4905999ae065a2c0e6ab
SSDEEP

192:HuE5+apEqf+0S6sxGv9aZUYwTyhLysafwNGxEgGAO:HGapBfgOAwTyhL8fw65GJ

Score

3^/10

Malware Config

Signatures

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
972	05cc6873a99d2167315bcf37efc6d9a8.exe

C:\Users\Admin\AppData\Local\Temp\05cc6873a99d2167315bcf37efc6d9a8.exe
"C:\Users\Admin\AppData\Local\Temp\05cc6873a99d2167315bcf37efc6d9a8.exe"
1⤵
- Suspicious use of SetWindowsHookEx
PID:972

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/972-0-0x0000000000400000-0x0000000000408000-memory.dmp

Filesize
32KB

Download
memory/972-1-0x00000000001D0000-0x00000000001D1000-memory.dmp

Filesize
4KB

Download
memory/972-4-0x0000000000400000-0x0000000000408000-memory.dmp

Filesize
32KB

Download