d67b23ec2e80246fd7f4aaad52d2fb138ce8f06a2ca1ae07e9d61e88260354a7

Analysis

max time kernel
2s
max time network
80s
platform
windows10-2004_x64
resource
win10v2004-20231222-en
resource tags

arch:x64arch:x86image:win10v2004-20231222-enlocale:en-usos:windows10-2004-x64system
submitted
08/01/2024, 23:50

Target

4cc8840e78f33f8d4d47a55815ea05dd.exe
Size

52KB
MD5

4cc8840e78f33f8d4d47a55815ea05dd
SHA1

3fb1f568aa231a09b88c4b4edea9c9347182d34d
SHA256

d67b23ec2e80246fd7f4aaad52d2fb138ce8f06a2ca1ae07e9d61e88260354a7
SHA512

17f04d5fde0d325ae85d4de68bd72ee2e64cc05ff6317a6246abf5fb4b735e92e5c8fce77010efe34b3dbea4a2f82141ff491d235223cac474cc71490075872a
SSDEEP

768:yNn1+MQ/j359nR9xUeMfVB1RLaP/v/0CISor5C6Rlwibw5zVzpAH:yyr3f99MfHzLaX30T5C6RlKpAH

Score

3^/10

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
1512	4cc8840e78f33f8d4d47a55815ea05dd.exe

C:\Users\Admin\AppData\Local\Temp\4cc8840e78f33f8d4d47a55815ea05dd.exe
"C:\Users\Admin\AppData\Local\Temp\4cc8840e78f33f8d4d47a55815ea05dd.exe"
1⤵
- Suspicious use of SetWindowsHookEx
PID:1512
- C:\Users\Admin\waeuk.exe
  "C:\Users\Admin\waeuk.exe"
  2⤵
  PID:740

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

memory/740-34-0x0000000000400000-0x0000000000410000-memory.dmp

Filesize
64KB

Download
memory/1512-0-0x0000000000400000-0x0000000000410000-memory.dmp

Filesize
64KB

Download