56d8cc5b78fc7aada90fad098cd5d192dc863189cd3fe8101cb7c8e112e87753

Analysis

max time kernel
119s
max time network
135s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
05/01/2024, 03:02

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

4298b58ad62497c5d090dd78707c22da.exe
Size

52KB
MD5

4298b58ad62497c5d090dd78707c22da
SHA1

d4b817507580f4ca82929abba2e841cd15930123
SHA256

56d8cc5b78fc7aada90fad098cd5d192dc863189cd3fe8101cb7c8e112e87753
SHA512

851f3ed303bcc754e328ac559fc3c37bccd75ee5632dbb554ffdeff0286c19656d265059c61b970f7a22f603c080e9c140dfc9572e61f8aac3cc486113ba7a6f
SSDEEP

768:xNvXnBNHOfHc0JE6kxGJaeJaUrbAE+u6nXfvELkLxY:xlXevhfOGJaBMBkNY

Score

3^/10

Malware Config

Signatures

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
1288	4298b58ad62497c5d090dd78707c22da.exe
1288	4298b58ad62497c5d090dd78707c22da.exe

C:\Users\Admin\AppData\Local\Temp\4298b58ad62497c5d090dd78707c22da.exe
"C:\Users\Admin\AppData\Local\Temp\4298b58ad62497c5d090dd78707c22da.exe"
1⤵
- Suspicious use of SetWindowsHookEx
PID:1288

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\D0I6KXNQ\òøQ‡!¦jNæ4½wþbÜ›[1].htm

Filesize
488B

MD5
008f5e573aea0166b8555a201d793e55

SHA1
f79095b314b5f74bf9b2b07b07e9613c8b772409

SHA256
59b88f09d2b2ff90a30c34e1454d1c6772d9ff366aab945bc3502215bbe8e487

SHA512
5e87a4780aa253f2de7831931ea7bb43d24c0969ce6a68cc561a7a03bf4554ddc40f84166c1f6909e218a0b1c67c4e0a0aeadd44efea25ded5ba264b385221ed

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\RU3RPYUN\cA[1].htm

Filesize
492B

MD5
743d829dd7231c1ad7f7503ca4bb75f2

SHA1
7e9f150caa815aba3270b0b8ec8d7e8a5b272bda

SHA256
e69cdfaf2f633f7f6d7f9c786187485cba534099a36963e6471e6682eb237f6b

SHA512
07abf7318250e66e9f26ad2af63e6a21765d6973eb7fd7955b988f4cb10321401c85c08726a39e17248f7a4a5fc81089e31ac252ac809f8e61aade5908c98bf5

Download Submit