40181b88c9f2190bd12080cc82496e63bcd7ba0b913146e1d96661c008a23f2d

Analysis

max time kernel
0s
max time network
142s
platform
windows10-2004_x64
resource
win10v2004-20231215-en
resource tags

arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
submitted
26/12/2023, 02:05

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

4b72a34232fae50072cb0c5c1e147cab.exe
Size

1.1MB
MD5

4b72a34232fae50072cb0c5c1e147cab
SHA1

4b920f0927b13e1f2042f02f5d45ac57826a6ba5
SHA256

40181b88c9f2190bd12080cc82496e63bcd7ba0b913146e1d96661c008a23f2d
SHA512

00f077dffae7e37a1d45163d90b09684bcb897e5f370e886c1cc481dbc73086c1d4254e11c0c56f338fedbc363b06d6899e257fb3c8a31504a95be07e2806abf
SSDEEP

24576:vnZaEED47I60ftaBnyGl4JBzTFpuMNExPP2:hiD47L0FHJdTFEMNExP

Score

4^/10

Malware Config

Signatures

Drops file in Program Files directory 1 IoCs

description	ioc	Process
File created	C:\PROGRA~2\is240601453.log	4b72a34232fae50072cb0c5c1e147cab.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
516	4b72a34232fae50072cb0c5c1e147cab.exe
516	4b72a34232fae50072cb0c5c1e147cab.exe

C:\Users\Admin\AppData\Local\Temp\4b72a34232fae50072cb0c5c1e147cab.exe
"C:\Users\Admin\AppData\Local\Temp\4b72a34232fae50072cb0c5c1e147cab.exe"
1⤵
- Drops file in Program Files directory
- Suspicious use of SetWindowsHookEx
PID:516

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/516-1-0x0000000000B20000-0x0000000000B21000-memory.dmp

Filesize
4KB

Download
memory/516-0-0x0000000000400000-0x0000000000517000-memory.dmp

Filesize
1.1MB

Download
memory/516-139-0x0000000000400000-0x0000000000517000-memory.dmp

Filesize
1.1MB

Download
memory/516-141-0x0000000000400000-0x0000000000517000-memory.dmp

Filesize
1.1MB

Download
memory/516-140-0x0000000000400000-0x0000000000517000-memory.dmp

Filesize
1.1MB

Download
memory/516-142-0x0000000000B20000-0x0000000000B21000-memory.dmp

Filesize
4KB

Download
memory/516-143-0x0000000000400000-0x0000000000517000-memory.dmp

Filesize
1.1MB

Download
memory/516-144-0x0000000000400000-0x0000000000517000-memory.dmp

Filesize
1.1MB

Download
memory/516-145-0x0000000000400000-0x0000000000517000-memory.dmp

Filesize
1.1MB

Download
memory/516-147-0x0000000000400000-0x0000000000517000-memory.dmp

Filesize
1.1MB

Download
memory/516-148-0x0000000000400000-0x0000000000517000-memory.dmp

Filesize
1.1MB

Download
memory/516-149-0x0000000000400000-0x0000000000517000-memory.dmp

Filesize
1.1MB

Download
memory/516-150-0x0000000000400000-0x0000000000517000-memory.dmp

Filesize
1.1MB

Download
memory/516-151-0x0000000000400000-0x0000000000517000-memory.dmp

Filesize
1.1MB

Download
memory/516-152-0x0000000000400000-0x0000000000517000-memory.dmp

Filesize
1.1MB

Download
memory/516-153-0x0000000000400000-0x0000000000517000-memory.dmp

Filesize
1.1MB

Download
memory/516-154-0x0000000000400000-0x0000000000517000-memory.dmp

Filesize
1.1MB

Download
memory/516-155-0x0000000000400000-0x0000000000517000-memory.dmp

Filesize
1.1MB

Download