53f6a769246ea84dbdf3eb081a9f2ddb62a1cc74a64dcb896a566c218d68063a

Analysis

max time kernel
182s
max time network
191s
platform
windows10-2004_x64
resource
win10v2004-20231215-en
resource tags

arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
submitted
28-12-2023 20:33

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

f634f6cd5baa1ed7c576177b780e2ce6.exe
Size

4.4MB
MD5

f634f6cd5baa1ed7c576177b780e2ce6
SHA1

95b8259e33a2786b66d28be4ae46a4bb7509e27c
SHA256

53f6a769246ea84dbdf3eb081a9f2ddb62a1cc74a64dcb896a566c218d68063a
SHA512

4378e13b8a9d23121344f17e985e7bc5a878b0587b40429cf06534ece2c7ea68f8f0f6424c5c2078f5c1b2754b84c70318e7216c171bafd807cc5800d8548a6b
SSDEEP

98304:OPTCtmOEdNE+mTlcpY47j3mnrDW4t32Nxavs:OWtmzNEIWkGvt32NYE

Score

3^/10

Malware Config

Signatures

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
3532	f634f6cd5baa1ed7c576177b780e2ce6.exe

C:\Users\Admin\AppData\Local\Temp\f634f6cd5baa1ed7c576177b780e2ce6.exe
"C:\Users\Admin\AppData\Local\Temp\f634f6cd5baa1ed7c576177b780e2ce6.exe"
1⤵
- Suspicious use of SetWindowsHookEx
PID:3532

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/3532-0-0x0000000000400000-0x000000000073C000-memory.dmp

Filesize
3.2MB

Download
memory/3532-1-0x00000000009B0000-0x00000000009B1000-memory.dmp

Filesize
4KB

Download
memory/3532-2-0x0000000000400000-0x000000000073C000-memory.dmp

Filesize
3.2MB

Download
memory/3532-3-0x0000000002850000-0x0000000002851000-memory.dmp

Filesize
4KB

Download
memory/3532-4-0x0000000000400000-0x000000000073C000-memory.dmp

Filesize
3.2MB

Download
memory/3532-5-0x0000000000400000-0x000000000073C000-memory.dmp

Filesize
3.2MB

Download
memory/3532-7-0x0000000002850000-0x0000000002851000-memory.dmp

Filesize
4KB

Download