4a1c8a08bb613a0211b77402f65cdc3f2c16c1d321b44c0eb0ed845bdf6b6b26

Analysis

max time kernel
3s
max time network
132s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
30/12/2023, 01:51

Target

0ab2a5662118c54ed31488b920aa3078.exe
Size

152KB
MD5

0ab2a5662118c54ed31488b920aa3078
SHA1

ad41e7ab3031ae88dacb28d05ea9c07614c56725
SHA256

4a1c8a08bb613a0211b77402f65cdc3f2c16c1d321b44c0eb0ed845bdf6b6b26
SHA512

0c071c3c4204752b2ea1585db6c0b82f742d451d0860119869959499b12c7db5cf7bf8246649d655cfdb9d4a2236b9d29ab1bbb27034da875bca3a524206dd19
SSDEEP

3072:LMGNPYYh0ZV+7DxNUbaxIcz93bOButK+Hog:0+7DxVh3bHYg

Score

3^/10

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
816	0ab2a5662118c54ed31488b920aa3078.exe

C:\Users\Admin\AppData\Local\Temp\0ab2a5662118c54ed31488b920aa3078.exe
"C:\Users\Admin\AppData\Local\Temp\0ab2a5662118c54ed31488b920aa3078.exe"
1⤵
- Suspicious use of SetWindowsHookEx
PID:816
- C:\Users\Admin\qeiija.exe
  "C:\Users\Admin\qeiija.exe"
  2⤵
  PID:2672

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact