8e16599b03092046a826a79d53e47d2fa5c8fbfb1e9d78a3ab5b43245350187c

Analysis

max time kernel
4s
max time network
120s
platform
windows10-2004_x64
resource
win10v2004-20231215-en
resource tags

arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
submitted
25/12/2023, 12:46

Target

1f86a188e113abd36d93f13f5ec8226d.exe
Size

240KB
MD5

1f86a188e113abd36d93f13f5ec8226d
SHA1

30c60924ff5f9a9b7e90a532cb477a804493cbbf
SHA256

8e16599b03092046a826a79d53e47d2fa5c8fbfb1e9d78a3ab5b43245350187c
SHA512

8a7ea14ba9d7adbb530e6fa23d99af64848ced73f6d7196ed3b4a7f55349a7426aa8f779dbd236d9c2a1939a13f5dc2b7361da37560055c92858e9c5dbf07a4b
SSDEEP

6144:fUB3dwqsNwemAB0EqxF6snji81RUinKchhytS3n:0dQQJsU3

Score

3^/10

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
3780	1f86a188e113abd36d93f13f5ec8226d.exe

C:\Users\Admin\AppData\Local\Temp\1f86a188e113abd36d93f13f5ec8226d.exe
"C:\Users\Admin\AppData\Local\Temp\1f86a188e113abd36d93f13f5ec8226d.exe"
1⤵
- Suspicious use of SetWindowsHookEx
PID:3780
- C:\Users\Admin\maikues.exe
  "C:\Users\Admin\maikues.exe"
  2⤵
  PID:1760

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact