fedb08b3ec7034a15e9dee7ed4dec1a854fb78e74285e1ee05c90f9e9e4f8b3e

Analysis

max time kernel
30s
max time network
32s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
26-03-2024 13:47

Target

chckik.exe
Size

413KB
MD5

d467222c3bd563cb72fa49302f80b079
SHA1

9335e2a36abb8309d8a2075faf78d66b968b2a91
SHA256

fedb08b3ec7034a15e9dee7ed4dec1a854fb78e74285e1ee05c90f9e9e4f8b3e
SHA512

484b6c427e28193ddb73dd7062e2bfbd132ddc72ce4811bfe08784669de30e4b92bc27140373f62a4ce651401000a3c505188620c43da410bf6b0799a0791fa7
SSDEEP

6144:0UorLrzMYSnDyTtDOYtf3J7+YZIPcrPJruPWeX2/e1Cw+GOpumhauZef6P5rwmx:0vcYZD17DMPWev1Cb3umhauZef6a

Score

4^/10

Drops file in Windows directory 1 IoCs

Processes:

chckik.exe

description ioc process

File created C:\Windows\Tasks\chrosha.job chckik.exe
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

description	ioc	process
File created	C:\Windows\Tasks\chrosha.job	chckik.exe

C:\Users\Admin\AppData\Local\Temp\chckik.exe
"C:\Users\Admin\AppData\Local\Temp\chckik.exe"
1⤵
- Drops file in Windows directory
PID:2820

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact