3a1844959cecbc1ea873ba533cadffe609c44fd5d573a3b342204cfdaf7eb664

Analysis

max time kernel
60s
max time network
122s
platform
windows10-2004_x64
resource
win10v2004-20231222-en
resource tags

arch:x64arch:x86image:win10v2004-20231222-enlocale:en-usos:windows10-2004-x64system
submitted
26/12/2023, 07:06

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

5b7876a89a0b0992b831d703c779b128.exe
Size

312KB
MD5

5b7876a89a0b0992b831d703c779b128
SHA1

ba4f633f961310f07af663e7ec39822710ac9960
SHA256

3a1844959cecbc1ea873ba533cadffe609c44fd5d573a3b342204cfdaf7eb664
SHA512

96d63c0c977e94d0078c4a02ae2d02eacd62425fb6e741931463e89ec258dc3dbe4148f6ab12f4c77fd48e233356fc6680f24b7c70848cbf4b69d49eba9688de
SSDEEP

6144:dC7tRvTlIpr1f+XqO5aOmSGFDbeOjLPmUPgn:+thTlIB1f+55SpNPmU4n

Score

3^/10

Malware Config

Signatures

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
828	5b7876a89a0b0992b831d703c779b128.exe

C:\Users\Admin\AppData\Local\Temp\5b7876a89a0b0992b831d703c779b128.exe
"C:\Users\Admin\AppData\Local\Temp\5b7876a89a0b0992b831d703c779b128.exe"
1⤵
- Suspicious use of SetWindowsHookEx
PID:828
- C:\Users\Admin\maawu.exe
  "C:\Users\Admin\maawu.exe"
  2⤵
  PID:636

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\maawu.exe

Filesize
23KB

MD5
d943f89f041aa48c6c280e70b5c4fdc6

SHA1
db32e4dc10d6f10274f0f74b16093734394b2993

SHA256
8237b2d2f5cdb4f013c58cf3fcbd9f325b41febc5046296b9a573124a249f3db

SHA512
42762ff765f6904d121b6f38aa54c507f2d32125d33def77cf34be3ad5d283901976e7e94a8e2a10d7c516d4b35bc881bb59de200d2edb5eb62dabd224e4e9cb

Download Submit
C:\Users\Admin\maawu.exe

Filesize
1KB

MD5
8a795f721219be684f78397f536a8ab8

SHA1
7e9ba4c49b7aee7783e6f3a771d99ffb2dcd68f0

SHA256
844d8acb6b2a86b94facda9260c19883a7735d062ca767ceb654d81fe0551b06

SHA512
c7f8e32bd0dde6cb69d48d5581389a7921c37d359927ebfb57a8fcade7789455913d6662bfe2fc2a88729a301f19cc0df5778c4b1d9498cb3041b83b7447b072

Download Submit