2c79d7bb689f831bf7bfa4e09b8ee0ec830d2e97c71c8b1716733f879a4d4bd0

Analysis

max time kernel
146s
max time network
148s
platform
windows10-2004_x64
resource
win10v2004-20231222-en
resource tags

arch:x64arch:x86image:win10v2004-20231222-enlocale:en-usos:windows10-2004-x64system
submitted
25/12/2023, 16:07

Target

2bd4d8d6d652d02e4e6715e6c360ce16.exe
Size

324KB
MD5

2bd4d8d6d652d02e4e6715e6c360ce16
SHA1

cd0dac06cf6d402977df04003ffba1e2ee092dd1
SHA256

2c79d7bb689f831bf7bfa4e09b8ee0ec830d2e97c71c8b1716733f879a4d4bd0
SHA512

19675563d5d350afc2d5b9e14ca8ef6f47642dce3a8d05bef961056b2f6e55fb63cd1fe2a900ac4197286291d517db8c0bc71abad411077bcbf029270a61ddc6
SSDEEP

6144:wmr3Tm0ozVmUWIoN2/Rs2ZJpuu5L3VpbDIKMhZ0:wmrXSWBsRswJp93VpbDIb8

Score

3^/10

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
1084	2bd4d8d6d652d02e4e6715e6c360ce16.exe
1084	2bd4d8d6d652d02e4e6715e6c360ce16.exe

C:\Users\Admin\AppData\Local\Temp\2bd4d8d6d652d02e4e6715e6c360ce16.exe
"C:\Users\Admin\AppData\Local\Temp\2bd4d8d6d652d02e4e6715e6c360ce16.exe"
1⤵
- Suspicious use of SetWindowsHookEx
PID:1084

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact