b9b96c444d64bc12849791790039fa2c38f7700f2d8d01c3377a40b3fd618e49

Analysis

max time kernel
142s
max time network
152s
platform
windows10-2004_x64
resource
win10v2004-20231215-en
resource tags

arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
submitted
10/01/2024, 01:09

Target

4f2e7d326d0e3e0961188ed254bf72bb.exe
Size

136KB
MD5

4f2e7d326d0e3e0961188ed254bf72bb
SHA1

a46dddc03a94e212b4bc44ad19ee0522bb520dde
SHA256

b9b96c444d64bc12849791790039fa2c38f7700f2d8d01c3377a40b3fd618e49
SHA512

c1388921465ff815ffc0bb24638f649f46c26ce4ebc2946fa407a04660036dad55f21a85cee345b435a24340dfaec18ac4e5d34b421ac8c84670fc85280997b3
SSDEEP

1536:JbSIOG8fa9dpKjde38vcYJDVheFEcuP8FD/X4wQxPQ838RdTG2efa9g:/Og9dpyvc4DVheFEcciQHC9G2B9g

Score

3^/10

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
740	4f2e7d326d0e3e0961188ed254bf72bb.exe
740	4f2e7d326d0e3e0961188ed254bf72bb.exe

C:\Users\Admin\AppData\Local\Temp\4f2e7d326d0e3e0961188ed254bf72bb.exe
"C:\Users\Admin\AppData\Local\Temp\4f2e7d326d0e3e0961188ed254bf72bb.exe"
1⤵
- Suspicious use of SetWindowsHookEx
PID:740

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact