Analysis

  • max time kernel
    3s
  • max time network
    116s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20231215-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
  • submitted
    25/12/2023, 15:27

General

  • Target

    2950ac29b39df3a8f6b678b425ab3812.exe

  • Size

    1.2MB

  • MD5

    2950ac29b39df3a8f6b678b425ab3812

  • SHA1

    145be0cd74eb933fb9c9d7045626d5efdc7595df

  • SHA256

    dd97405f10f6f1ffb0695bd690b8cb6917b31b5832bf8da508f7f0c90ab9be65

  • SHA512

    7f66a44280a018897678174d1413204b8222bc8a89f374586e94fa321f244d0f9ba378149a932348ac8b75d7b79164335642a85f336ab064a19f0360b2fb31fe

  • SSDEEP

    24576:pi3Uh+ddkbatLngiPzQdVqxpG8jtOR9GGZXEW/urSR8lMR7KZb7vFl:cU4BLngir9xpjjtQNXvurSRS2ib7d

Score
7/10

Malware Config

Signatures

  • VMProtect packed file 3 IoCs

    Detects executables packed with VMProtect commercial packer.

  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Suspicious use of SetWindowsHookEx 1 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\2950ac29b39df3a8f6b678b425ab3812.exe
    "C:\Users\Admin\AppData\Local\Temp\2950ac29b39df3a8f6b678b425ab3812.exe"
    1⤵
    • Suspicious use of SetWindowsHookEx
    PID:4940

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • memory/4940-0-0x0000000000AE0000-0x0000000000DFA000-memory.dmp

    Filesize

    3.1MB

  • memory/4940-1-0x0000000000AE0000-0x0000000000DFA000-memory.dmp

    Filesize

    3.1MB

  • memory/4940-4-0x0000000000AE0000-0x0000000000DFA000-memory.dmp

    Filesize

    3.1MB