Analysis

  • max time kernel
    159s
  • max time network
    164s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20231215-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
  • submitted
    13/01/2024, 10:15

General

  • Target

    58aa896f6cb4a19722dc137654b7388c.exe

  • Size

    7.3MB

  • MD5

    58aa896f6cb4a19722dc137654b7388c

  • SHA1

    a05d8a13f68b153ceba50162d4626b3859d958be

  • SHA256

    ec60a6d24c4845423f44230f9f1b2426544e0db3ff263a4597adf3992f92f8a7

  • SHA512

    9749c7286b9b58f1ba87dd742b14c8f86d4bef43d08d58a06956c3623e6ee9a950d9d2ed621a4f8194344bc92c4e1835c02af0a43b91c5715a02b6d3f96fe5dc

  • SSDEEP

    98304:pgCUjs/OOZe3xxfZ8NhxRVBSbL6Sys6F0yscToz4YYKUu/VPuzzIrh:p5VnZe3R9BLn/VPuzC

Score
3/10

Malware Config

Signatures

  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Suspicious behavior: EnumeratesProcesses 2 IoCs
  • Suspicious use of SetWindowsHookEx 2 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\58aa896f6cb4a19722dc137654b7388c.exe
    "C:\Users\Admin\AppData\Local\Temp\58aa896f6cb4a19722dc137654b7388c.exe"
    1⤵
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of SetWindowsHookEx
    PID:4852

Network

        MITRE ATT&CK Enterprise v15

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        • memory/4852-0-0x0000000002AB0000-0x0000000002AB1000-memory.dmp

          Filesize

          4KB

        • memory/4852-1-0x0000000000400000-0x0000000000B49000-memory.dmp

          Filesize

          7.3MB

        • memory/4852-2-0x0000000000400000-0x0000000000B49000-memory.dmp

          Filesize

          7.3MB

        • memory/4852-3-0x0000000002AB0000-0x0000000002AB1000-memory.dmp

          Filesize

          4KB