470fd3e08686786e52808af269c13c117eafc809afc2b03ca0376ab6951b76bb

Analysis

max time kernel
4s
max time network
49s
platform
windows10-2004_x64
resource
win10v2004-20231215-en
resource tags

arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
submitted
25/12/2023, 12:00

Target

1ca21630212d52c15ff9261799b3e74a.exe
Size

228KB
MD5

1ca21630212d52c15ff9261799b3e74a
SHA1

d2f42b687cf6e8fdd815c0fe8dc47e0701b4152f
SHA256

470fd3e08686786e52808af269c13c117eafc809afc2b03ca0376ab6951b76bb
SHA512

f34e2014b3c55a11056c0d2259203a4cb7e74535fc975da0ba8e33ca43ee90ba7fbb8ff4917415b72040e03838c7e7853c66081b4b4a803154ac36204479ab1f
SSDEEP

6144:jmd3PFKs7aFwKWwalhrEqxF6snji81RUinKZHg/aS8:jmpPhAmZIH+ax

Score

3^/10

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
4500	1ca21630212d52c15ff9261799b3e74a.exe

C:\Users\Admin\AppData\Local\Temp\1ca21630212d52c15ff9261799b3e74a.exe
"C:\Users\Admin\AppData\Local\Temp\1ca21630212d52c15ff9261799b3e74a.exe"
1⤵
- Suspicious use of SetWindowsHookEx
PID:4500
- C:\Users\Admin\saioyud.exe
  "C:\Users\Admin\saioyud.exe"
  2⤵
  PID:2736

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact