24779cc56e5bf3bca515ab974c8fd76d6c9fd845eca65fa65847733b30d9eba4

Analysis

max time kernel
145s
max time network
146s
platform
windows10-2004_x64
resource
win10v2004-20231215-en
resource tags

arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
submitted
19-01-2024 10:18

Target

675d673a9d78e63f490126ac88a8a3e4.exe
Size

630KB
MD5

675d673a9d78e63f490126ac88a8a3e4
SHA1

c99bc98116e54f145d423a041e56288f9ddc4b9c
SHA256

24779cc56e5bf3bca515ab974c8fd76d6c9fd845eca65fa65847733b30d9eba4
SHA512

4d99d274ea0eee8c4937d676b870eafe83664323a67deeef0cab5694f40e1a7c8bdb040b83244615cf9eab2569ff0adc10854f48b1954ecabd844756be68ffd8
SSDEEP

12288:UgUJj98qfQx6AJZpqMwfYHes9tcvYpsXp8/+WtV+SqzupPXK63rRRI:UgUjNQgAfpqMwfQeK8YrBIPypPpRRI

Score

3^/10

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082
Suspicious use of FindShellTrayWindow 1 IoCs

Processes:

675d673a9d78e63f490126ac88a8a3e4.exe

pid process

1820 675d673a9d78e63f490126ac88a8a3e4.exe

pid	process
1820	675d673a9d78e63f490126ac88a8a3e4.exe

C:\Users\Admin\AppData\Local\Temp\675d673a9d78e63f490126ac88a8a3e4.exe
"C:\Users\Admin\AppData\Local\Temp\675d673a9d78e63f490126ac88a8a3e4.exe"
1⤵
- Suspicious use of FindShellTrayWindow
PID:1820

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Resource Development

Reconnaissance