132dda9d53934e1bef3179e6e1501a5b0b179f18b4287cf485b42845b6c73bcf

Analysis

max time kernel
94s
max time network
117s
platform
windows10-2004_x64
resource
win10v2004-20231222-en
resource tags

arch:x64arch:x86image:win10v2004-20231222-enlocale:en-usos:windows10-2004-x64system
submitted
25/12/2023, 06:50

Target

0cc9dd47c05b8fa95f3627e0610a081a.exe
Size

324KB
MD5

0cc9dd47c05b8fa95f3627e0610a081a
SHA1

4d07e1169f1fd71566643e5110074d09f549d788
SHA256

132dda9d53934e1bef3179e6e1501a5b0b179f18b4287cf485b42845b6c73bcf
SHA512

a3dfd1a842a8b8cbe25e12bbdf57a43f1c3f74713c56ca7f920226017f6dfceadac7ae3354c7b846f0a5940d1334eefd24bcf267cd3a61cc73b528d50ddbccbb
SSDEEP

6144:xMJZmjTbPHtYxAc3W/jLVmP5okFoGaxf7x+Ism0gd:xMcvcaJmP5okaxDx+IsW

Score

3^/10

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
3232	0cc9dd47c05b8fa95f3627e0610a081a.exe
3232	0cc9dd47c05b8fa95f3627e0610a081a.exe

C:\Users\Admin\AppData\Local\Temp\0cc9dd47c05b8fa95f3627e0610a081a.exe
"C:\Users\Admin\AppData\Local\Temp\0cc9dd47c05b8fa95f3627e0610a081a.exe"
1⤵
- Suspicious use of SetWindowsHookEx
PID:3232

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact