798f20cde8ab0fb35f8e67175a9840e2d2b332e236ddc99bb4c58af15a3702b3

Analysis

max time kernel
134s
max time network
169s
platform
windows10-2004_x64
resource
win10v2004-20231215-en
resource tags

arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
submitted
30-12-2023 01:08

Target

099390b82d729baf90c3ea1a64b1c974.exe
Size

56KB
MD5

099390b82d729baf90c3ea1a64b1c974
SHA1

fdceee6f83a5eb0e22cae1b636c08962fc88d547
SHA256

798f20cde8ab0fb35f8e67175a9840e2d2b332e236ddc99bb4c58af15a3702b3
SHA512

045fdd41ed84ce399692ee674ebdab281a5ca892020729f7be1bbf1f96ceb112a3aa936f55043fb8d728c157963d1c3e54dafe188d095f4cd6fdbaa05f2a078e
SSDEEP

768:/768i82bCs14WdxjtTxgd2WdPddJa0SnUBkqqV8Ii8:/eAfsrxgsWdVdJaJn3qG88

Score

3^/10

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
912	099390b82d729baf90c3ea1a64b1c974.exe

C:\Users\Admin\AppData\Local\Temp\099390b82d729baf90c3ea1a64b1c974.exe
"C:\Users\Admin\AppData\Local\Temp\099390b82d729baf90c3ea1a64b1c974.exe"
1⤵
- Suspicious use of SetWindowsHookEx
PID:912

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact