41be930aee6f43f3c0126ac36561f5518b2295761f6b4fda0b4def48795c8585

Analysis

max time kernel
4s
max time network
149s
platform
windows10-2004_x64
resource
win10v2004-20231222-en
resource tags

arch:x64arch:x86image:win10v2004-20231222-enlocale:en-usos:windows10-2004-x64system
submitted
28/12/2023, 22:53

Target

fe20313bb10463d577dec2671064f6c2.exe
Size

232KB
MD5

fe20313bb10463d577dec2671064f6c2
SHA1

0e2811ad7b788c834b5cb239b80dc35bbb6e329f
SHA256

41be930aee6f43f3c0126ac36561f5518b2295761f6b4fda0b4def48795c8585
SHA512

88ad76b0bd17bfe6deddc09b87db9105f800f9961093ed148ea9117b7241458a6c5696226d23b642a70aea97330320877e420dad20c395d929787587536aa623
SSDEEP

6144:9c/XnhctRnmMhpL9J53vTRi52mwzBVvQ:+5cjnDnL9J53vFi52mwvvQ

Score

3^/10

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
1628	fe20313bb10463d577dec2671064f6c2.exe

C:\Users\Admin\AppData\Local\Temp\fe20313bb10463d577dec2671064f6c2.exe
"C:\Users\Admin\AppData\Local\Temp\fe20313bb10463d577dec2671064f6c2.exe"
1⤵
- Suspicious use of SetWindowsHookEx
PID:1628
- C:\Users\Admin\yaehae.exe
  "C:\Users\Admin\yaehae.exe"
  2⤵
  PID:1300

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

C:\Users\Admin\yaehae.exe

Filesize
92KB

MD5
00437a6a2a42b01236faf89552016e57

SHA1
2af529f1a54bb437058951407d1119886f1342db

SHA256
15ba1927a6ce4b41e1148b24d665b3a58576142eb6be94fb8196570b0e5fcea9

SHA512
dfd4a859b468959cd8af92c6a1627b1b0262389a1f8342530383883de9634a7ba65a2bf72bcdcf1df9a56a1eb07d0b67356796906d02864012b64651aa61c1e2

Download Submit
C:\Users\Admin\yaehae.exe

Filesize
232KB

MD5
c9bfe32ffb2b99ce54dd5ac678683721

SHA1
285b393dd5c23281e8caae74d8e2e0c701233d20

SHA256
64204f81ea5cc5751fe2b5e99fabf4c2d837763c2aca46c42635731ef8248f19

SHA512
01f21a3eb3c052b64dffe7e7c6a9bde0fba10032469f77aa4d2e3b4fd7da2883848c61f2c8fe7bc95c1f6b6e93a0a0e6bc1344a60c0bbd4b7e9e29b6bcfcea05

Download Submit