d3a4b2a353d46dc4e715142dd680461924ae329d5e71f5ea04748f4182a7e2a1

Analysis

max time kernel
2s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20231222-en
resource tags

arch:x64arch:x86image:win10v2004-20231222-enlocale:en-usos:windows10-2004-x64system
submitted
09/01/2024, 18:54

Target

f052d312699700405ff1e05a969bd13a.exe
Size

111KB
MD5

f052d312699700405ff1e05a969bd13a
SHA1

25cd0668a68c4d5123e968af831a71ae60e39dd1
SHA256

d3a4b2a353d46dc4e715142dd680461924ae329d5e71f5ea04748f4182a7e2a1
SHA512

34e330b77ba6a68f7ee5b98a47266e40da396560a1742c14c9917eca41246444e5ab6eddd842a02fc3f0ffb19a5d0f192dcc33e37f774bdf3da075fb4ac00fd6
SSDEEP

3072:t1/jMA8op4D4dMz4n4N4t4R4aEIIIIzH:t1/jgoxMdEIIIIz

Score

3^/10

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
5052	f052d312699700405ff1e05a969bd13a.exe

C:\Users\Admin\AppData\Local\Temp\f052d312699700405ff1e05a969bd13a.exe
"C:\Users\Admin\AppData\Local\Temp\f052d312699700405ff1e05a969bd13a.exe"
1⤵
- Suspicious use of SetWindowsHookEx
PID:5052
- C:\Users\Admin\vadeg.exe
  "C:\Users\Admin\vadeg.exe"
  2⤵
  PID:4836

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact