748f94cd164b60cec19d6353d609252813cfb378e72727573b4cfe29403c8ffd

Analysis

max time kernel
4s
max time network
156s
platform
windows10-2004_x64
resource
win10v2004-20231215-en
resource tags

arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
submitted
31/12/2023, 00:51

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

981d78dc925222eabf5bf2b268c2aabba8b9d25ad62b4406afb1198847cd4ebe.exe
Size

9.8MB
MD5

77798895d180e0b70a650e81ebe911e4
SHA1

06e1073549feaf566b999a7be57ea00d130ae1d7
SHA256

981d78dc925222eabf5bf2b268c2aabba8b9d25ad62b4406afb1198847cd4ebe
SHA512

c8cf10d84dbfd4976e4446c53e31ddf8b89de24e683036c42a095060b05cc3ed2efca9cc25e32e7ca5735b61b34b5a16f131a4fcb4256e667cf9fc59182fdf43
SSDEEP

196608:9XI+y0cv7pNJiNzV9EeXz0a2AH/wk57sYD6AGigYEbwfrbr4JFSaDMigmv4fl+ji:rcv7pNJimeXF2Rk5/hehbwfrFWMTmElH

Score

3^/10

Malware Config

Signatures

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious use of SetWindowsHookEx 4 IoCs

pid	Process
3892	981d78dc925222eabf5bf2b268c2aabba8b9d25ad62b4406afb1198847cd4ebe.exe
3892	981d78dc925222eabf5bf2b268c2aabba8b9d25ad62b4406afb1198847cd4ebe.exe
3892	981d78dc925222eabf5bf2b268c2aabba8b9d25ad62b4406afb1198847cd4ebe.exe
3892	981d78dc925222eabf5bf2b268c2aabba8b9d25ad62b4406afb1198847cd4ebe.exe

C:\Users\Admin\AppData\Local\Temp\981d78dc925222eabf5bf2b268c2aabba8b9d25ad62b4406afb1198847cd4ebe.exe
"C:\Users\Admin\AppData\Local\Temp\981d78dc925222eabf5bf2b268c2aabba8b9d25ad62b4406afb1198847cd4ebe.exe"
1⤵
- Suspicious use of SetWindowsHookEx
PID:3892
- C:\Windows\splwow64.exe
  C:\Windows\splwow64.exe 12288
  2⤵
  PID:3268

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k PrintWorkflow -s PrintWorkflowUserSvc
1⤵
PID:2756

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/3892-0-0x0000000000400000-0x00000000026E9000-memory.dmp

Filesize
34.9MB

Download
memory/3892-1-0x0000000000400000-0x00000000026E9000-memory.dmp

Filesize
34.9MB

Download
memory/3892-2-0x0000000004490000-0x0000000004491000-memory.dmp

Filesize
4KB

Download
memory/3892-7-0x0000000000400000-0x00000000026E9000-memory.dmp

Filesize
34.9MB

Download
memory/3892-8-0x0000000000400000-0x00000000026E9000-memory.dmp

Filesize
34.9MB

Download
memory/3892-9-0x0000000000400000-0x00000000026E9000-memory.dmp

Filesize
34.9MB

Download
memory/3892-11-0x0000000004490000-0x0000000004491000-memory.dmp

Filesize
4KB

Download