f32ade747efbed7486284adb1b8ec38b4d593330369b6b52f4b3479f8b0688e3

Analysis

max time kernel
144s
max time network
122s
platform
windows7_x64
resource
win7-20231129-en
resource tags

arch:x64arch:x86image:win7-20231129-enlocale:en-usos:windows7-x64system
submitted
18-01-2024 13:03

Target

$SYSDIR/50_Cent_Screensaver.scr
Size

4.1MB
MD5

dc1845f8395fab8ec586a58a60561567
SHA1

c2d06972be8964a4ea48e04c37a09053fea5b612
SHA256

fcef462ab79f13692334dd433e99b8bfd05cd3b2ff16856eb8756b358c5965e4
SHA512

1ee82491243d2a16d9fea7d0dac7600fffb7ecae3d0652eb62c5337cb60df24780fdc985b4253e352d06a5eacb6492a3d179e18e4e7b48f7296e16184b643d44
SSDEEP

98304:HsVVhyXINiBncoKqis0MYD2UICrAC99k+Gx:RYNgLiqYfIolgHx

Score

3^/10

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious use of SetWindowsHookEx 4 IoCs

C:\Users\Admin\AppData\Local\Temp\$SYSDIR\50_Cent_Screensaver.scr
"C:\Users\Admin\AppData\Local\Temp\$SYSDIR\50_Cent_Screensaver.scr" /S
1⤵
- Suspicious use of SetWindowsHookEx
PID:2180

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact