ad4d1cf408b9ebe6cbf0d738ef6ae43c77a1d3f430cddd3e13296226b94ffb35

Analysis

max time kernel
117s
max time network
121s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
11/03/2024, 19:04

Target

ad4d1cf408b9ebe6cbf0d738ef6ae43c77a1d3f430cddd3e13296226b94ffb35.exe
Size

2.5MB
MD5

faaefa236c9b0b4296823e549e042b1c
SHA1

a089e587fcddd2320f7fc44c250b149b7a8600d3
SHA256

ad4d1cf408b9ebe6cbf0d738ef6ae43c77a1d3f430cddd3e13296226b94ffb35
SHA512

03493fd88209d8650d2434a85d03550b79a51cb85a3efece8ae92dd6735eae3d0c9ff2b3d194706cd0aa43dae723f50dacc9ba530d6c219dc1a82024ece0d45e
SSDEEP

49152:yezYpGxKt0afOmPJvA1TS41aZE7PBryYYb+MITeNbdO:yezNKtnfOF1TSKt7PBryYrTeN

Score

3^/10

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
1716	ad4d1cf408b9ebe6cbf0d738ef6ae43c77a1d3f430cddd3e13296226b94ffb35.exe
1716	ad4d1cf408b9ebe6cbf0d738ef6ae43c77a1d3f430cddd3e13296226b94ffb35.exe

C:\Users\Admin\AppData\Local\Temp\ad4d1cf408b9ebe6cbf0d738ef6ae43c77a1d3f430cddd3e13296226b94ffb35.exe
"C:\Users\Admin\AppData\Local\Temp\ad4d1cf408b9ebe6cbf0d738ef6ae43c77a1d3f430cddd3e13296226b94ffb35.exe"
1⤵
- Suspicious use of SetWindowsHookEx
PID:1716

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact