29d7bcce549e42be131c7c3d39a46fe884925ceb742dc8cc1da7f6cae804f4cb

Analysis

max time kernel
147s
max time network
122s
platform
windows7_x64
resource
win7-20240508-en
resource tags

arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system
submitted
20/06/2024, 22:27

Target
$SYSDIR/Jennie_Finch_Screensaver.scr
Size 3.6MB
Sample240620-2dgmbazfqa
SHA256 98c8f946a121c5dd0743d43f8e286b0883f5e562b7120ade24b3b3603d01ab75
MD5 6a4d0b2d75851d844e1faad2a0e4ee69
SHA1 70ff2cd4ce4f56e03a4b1e1fd3903723fe47cbb2
SHA512 14434eb350245f00b87ad67dd23176a65d207274b634e80032b0ec2eef4acc8d7589e525f469d6cbc47f138803f4d5b495f3ad439d43a2ca5d4ca2ff0e7640f1
SSDEEP 98304:H+zn2M6MkLClncZx9aq0btXtGg+p2sWuJ:In25l2lox9apXUg+EPuJ
MD5 SHA1 SHA512 SSDEEP

Score

3^/10

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious use of SetWindowsHookEx 4 IoCs

pid	Process
2884	Jennie_Finch_Screensaver.scr
2884	Jennie_Finch_Screensaver.scr
2884	Jennie_Finch_Screensaver.scr
2884	Jennie_Finch_Screensaver.scr

C:\Users\Admin\AppData\Local\Temp\$SYSDIR\Jennie_Finch_Screensaver.scr
"C:\Users\Admin\AppData\Local\Temp\$SYSDIR\Jennie_Finch_Screensaver.scr" /S
1⤵
- Suspicious use of SetWindowsHookEx
PID:2884

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact