e02f4d186f740586f3d356db7bbbf3e69d3e78f4983598a7555be9cb720fbb50

Analysis

max time kernel
142s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20231215-en
resource tags

arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
submitted
04/02/2024, 16:36

Target

8fa3b84b97ecb168ebee8c94ed3e4908.exe
Size

48KB
MD5

8fa3b84b97ecb168ebee8c94ed3e4908
SHA1

d200951fc47ecc8669bc4b1abdce8156c81c58af
SHA256

e02f4d186f740586f3d356db7bbbf3e69d3e78f4983598a7555be9cb720fbb50
SHA512

5a5d96b5c64043a2b60a5d646283497dc115e25c82f93261fed02583718eef85772024437b81f85f558d4302bbd5e738d37aa2ffb938f2eb9967ba0c7f72c500
SSDEEP

384:eGmAm/rz4gjR4u4bjZyJrs7m2QpYcSDvFntLJVZCK1EQbELPlPI:CR/R4kJrsa2Qa5DvVtF/JEzlA

Score

3^/10

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
4112	8fa3b84b97ecb168ebee8c94ed3e4908.exe
4112	8fa3b84b97ecb168ebee8c94ed3e4908.exe

C:\Users\Admin\AppData\Local\Temp\8fa3b84b97ecb168ebee8c94ed3e4908.exe
"C:\Users\Admin\AppData\Local\Temp\8fa3b84b97ecb168ebee8c94ed3e4908.exe"
1⤵
- Suspicious use of SetWindowsHookEx
PID:4112

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact