e6c6bd02fa5f256653f81e8a8ef13fabfbcc0ba75a1ee41a83afb2199ea11d57

Analysis

max time kernel
147s
max time network
121s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
26-03-2024 11:23

Target

$SYSDIR/Nicolas_Sarkozy_Screensaver.scr
Size

3.4MB
MD5

c873e406238a8aa456d4fc0cecbca759
SHA1

b3b7c97b9615b7b879a4c875bbd8d034ca637f5b
SHA256

9df92a772cdb4406f96e35346c4f45d96c5e06472785e018e6378c1865b2e1b6
SHA512

e23bf2696238b775a46eaf5cf026bba6846befe9de84bbb36ddfd46b42c016dff1c0a8c21bfb47b29edbb15ca25bd28c43c2f413a786c1c0664666aeeb6beda0
SSDEEP

49152:HSza2TROr8QGvfthfrrLDdW9oOpLEz1AolAKtKzOJz9VTvuBHDDW3qC1eK:H6u8Lv7rnDdpnFzWu311eK

Score

3^/10

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious use of SetWindowsHookEx 4 IoCs

pid	Process
2032	Nicolas_Sarkozy_Screensaver.scr
2032	Nicolas_Sarkozy_Screensaver.scr
2032	Nicolas_Sarkozy_Screensaver.scr
2032	Nicolas_Sarkozy_Screensaver.scr

C:\Users\Admin\AppData\Local\Temp\$SYSDIR\Nicolas_Sarkozy_Screensaver.scr
"C:\Users\Admin\AppData\Local\Temp\$SYSDIR\Nicolas_Sarkozy_Screensaver.scr" /S
1⤵
- Suspicious use of SetWindowsHookEx
PID:2032

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact