47ba30f21cb191390ccbd1eda0ffadf06a153401fb8c30450de3b8274ab631d6

Analysis

max time kernel
4s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20231222-en
resource tags

arch:x64arch:x86image:win10v2004-20231222-enlocale:en-usos:windows10-2004-x64system
submitted
06/01/2024, 13:50

Target

4663d3377db0aac35daaa69048f37778.exe
Size

240KB
MD5

4663d3377db0aac35daaa69048f37778
SHA1

485956e49e4fa055c86543aa0c5dc2a6cfb8bfef
SHA256

47ba30f21cb191390ccbd1eda0ffadf06a153401fb8c30450de3b8274ab631d6
SHA512

c555c6d4dac833e4318b11be0533856820677f1092a79daf8c7c74f7779b4a87591dde3d90f20b87cde78cafda715cf4d733417b5e7fb69d89446b47ddb6dcb4
SSDEEP

6144:JUX3dwqsNweTAB0EqxF6snji81RUinKchhtrSf:sdQ5JDmf

Score

3^/10

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
4848	4663d3377db0aac35daaa69048f37778.exe

C:\Users\Admin\AppData\Local\Temp\4663d3377db0aac35daaa69048f37778.exe
"C:\Users\Admin\AppData\Local\Temp\4663d3377db0aac35daaa69048f37778.exe"
1⤵
- Suspicious use of SetWindowsHookEx
PID:4848
- C:\Users\Admin\keudao.exe
  "C:\Users\Admin\keudao.exe"
  2⤵
  PID:3984

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact