8ff9f67f4a72fc61401976bb57bf5848ae2eeadd2004e15f36833bd6b2658d77

Analysis

max time kernel
117s
max time network
120s
platform
windows7_x64
resource
win7-20231129-en
resource tags

arch:x64arch:x86image:win7-20231129-enlocale:en-usos:windows7-x64system
submitted
26/01/2024, 00:31

Target

75ea3ef31e74489606bb11d022cd9ce3.exe
Size

20KB
MD5

75ea3ef31e74489606bb11d022cd9ce3
SHA1

f06068d720abd00f05ac00c7570b5a55dc1565b6
SHA256

8ff9f67f4a72fc61401976bb57bf5848ae2eeadd2004e15f36833bd6b2658d77
SHA512

1fb2c7f7ccdf09e7944290811a5308790a131b0a643018cc4ec9ca663ddf4f3bb358710e4390e586fa2d724d82b850c33735b6f13010f937047590dcdc519237
SSDEEP

192:ZIqInaiX32vTadETIAQ4MP1oynNgfKQnaDEiT:eao4MAC1zgfJ+Ei

Score

3^/10

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
1704	75ea3ef31e74489606bb11d022cd9ce3.exe
1704	75ea3ef31e74489606bb11d022cd9ce3.exe

C:\Users\Admin\AppData\Local\Temp\75ea3ef31e74489606bb11d022cd9ce3.exe
"C:\Users\Admin\AppData\Local\Temp\75ea3ef31e74489606bb11d022cd9ce3.exe"
1⤵
- Suspicious use of SetWindowsHookEx
PID:1704

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact