f97a07b2435ebb40d8eab22299f0fb72338c6a49a9c6ed9e9e92fc95bff4d4ed

Analysis

max time kernel
149s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20240426-en
resource tags

arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system
submitted
03/06/2024, 07:33

Target
f97a07b2435ebb40d8eab22299f0fb72338c6a49a9c6ed9e9e92fc95bff4d4ed.exe
Size 7.0MB
Sample240603-jdk1magb41
SHA256 f97a07b2435ebb40d8eab22299f0fb72338c6a49a9c6ed9e9e92fc95bff4d4ed
MD5 70f3a2590b80c7e045c0e9999ad4ec56
SHA1 81da13ccab4b430bac3130195d0edf30246b0334
SHA512 85f8dbad2710914aa6461413f09111dfd3429985bc1ce40ad65335f46da11a41564edc91cc2ff50973cff18a0ec3dd2ac44164d46a46db013b4a93290fe035de
SSDEEP 98304:1rSrOcB70ZqsrdRwPRyyaikfF2xP0sE8RB0M2m5cbd9zEg1MVSkCDcM:oPB4RUoLMxP0sFjGzr1Ow
MD5 SHA1 SHA512 SSDEEP

Score

6^/10

discovery

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
4232	f97a07b2435ebb40d8eab22299f0fb72338c6a49a9c6ed9e9e92fc95bff4d4ed.exe
4232	f97a07b2435ebb40d8eab22299f0fb72338c6a49a9c6ed9e9e92fc95bff4d4ed.exe

C:\Users\Admin\AppData\Local\Temp\f97a07b2435ebb40d8eab22299f0fb72338c6a49a9c6ed9e9e92fc95bff4d4ed.exe
"C:\Users\Admin\AppData\Local\Temp\f97a07b2435ebb40d8eab22299f0fb72338c6a49a9c6ed9e9e92fc95bff4d4ed.exe"
1⤵
- Suspicious use of SetWindowsHookEx
PID:4232

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

Lateral Movement

Collection

Command and Control

Exfiltration

Impact