8419f35549c2749834a3ac4926b9f488c60785631cf3ee3eecf3a035d6225515

Analysis

max time kernel
140s
max time network
123s
platform
windows7_x64
resource
win7-20240508-en
resource tags

arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system
submitted
12/06/2024, 15:00

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
caddll/Demos/Exe/Win32/ExportDemoVC.exe
Size 19KB
Sample240612-sdp41stalq
SHA256 ddb80a17a15986c1b48f166e7c8d65523d94064b1a7aff36e8ad03a443195be1
MD5 b3887f5a1a430de5a944da647837dd57
SHA1 2dbff76425396d98e33f0f7752aad9c2e391d2cf
SHA512 4234da5e59c212206d0c8a6749377708ccff2ba83c3c84f51a715f4cd4c9ff1dfbfda12eb71c3cdd8cc01c9976fdf933ca764a0203ce6a0c61e6e662e58ecdb5
SSDEEP 384:WU1HvfB+aTL41JjF16tdDVFFHROTVQzvAucH:LRJkJjP6tXxOxQzvx
MD5 SHA1 SHA512 SSDEEP

Score

3^/10

Malware Config

Signatures

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
2984	ExportDemoVC.exe
2984	ExportDemoVC.exe

C:\Users\Admin\AppData\Local\Temp\caddll\Demos\Exe\Win32\ExportDemoVC.exe
"C:\Users\Admin\AppData\Local\Temp\caddll\Demos\Exe\Win32\ExportDemoVC.exe"
1⤵
- Suspicious use of SetWindowsHookEx
PID:2984

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2984-0-0x00000000000A0000-0x00000000000A1000-memory.dmp

Download

memory/2984-1-0x000000004FFB0000-0x0000000050856000-memory.dmp