e6c6bd02fa5f256653f81e8a8ef13fabfbcc0ba75a1ee41a83afb2199ea11d57

Analysis

max time kernel
149s
max time network
141s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
26-03-2024 11:23

Target

$SYSDIR/Nicolas_Sarkozy_Screensaver.scr
Size

3.4MB
MD5

c873e406238a8aa456d4fc0cecbca759
SHA1

b3b7c97b9615b7b879a4c875bbd8d034ca637f5b
SHA256

9df92a772cdb4406f96e35346c4f45d96c5e06472785e018e6378c1865b2e1b6
SHA512

e23bf2696238b775a46eaf5cf026bba6846befe9de84bbb36ddfd46b42c016dff1c0a8c21bfb47b29edbb15ca25bd28c43c2f413a786c1c0664666aeeb6beda0
SSDEEP

49152:HSza2TROr8QGvfthfrrLDdW9oOpLEz1AolAKtKzOJz9VTvuBHDDW3qC1eK:H6u8Lv7rnDdpnFzWu311eK

Score

3^/10

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious use of SetWindowsHookEx 4 IoCs

pid	Process
1468	Nicolas_Sarkozy_Screensaver.scr
1468	Nicolas_Sarkozy_Screensaver.scr
1468	Nicolas_Sarkozy_Screensaver.scr
1468	Nicolas_Sarkozy_Screensaver.scr

C:\Users\Admin\AppData\Local\Temp\$SYSDIR\Nicolas_Sarkozy_Screensaver.scr
"C:\Users\Admin\AppData\Local\Temp\$SYSDIR\Nicolas_Sarkozy_Screensaver.scr" /S
1⤵
- Suspicious use of SetWindowsHookEx
PID:1468

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=4080 --field-trial-handle=2260,i,3303482231723870786,2954015409682154873,262144 --variations-seed-version /prefetch:8
1⤵
PID:1380

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact