29d7bcce549e42be131c7c3d39a46fe884925ceb742dc8cc1da7f6cae804f4cb

Analysis

max time kernel
149s
max time network
127s
platform
windows10-2004_x64
resource
win10v2004-20240611-en
resource tags

arch:x64arch:x86image:win10v2004-20240611-enlocale:en-usos:windows10-2004-x64system
submitted
20/06/2024, 22:27

Target
$SYSDIR/Jennie_Finch_Screensaver.scr
Size 3.6MB
Sample240620-2dgmbazfqa
SHA256 98c8f946a121c5dd0743d43f8e286b0883f5e562b7120ade24b3b3603d01ab75
MD5 6a4d0b2d75851d844e1faad2a0e4ee69
SHA1 70ff2cd4ce4f56e03a4b1e1fd3903723fe47cbb2
SHA512 14434eb350245f00b87ad67dd23176a65d207274b634e80032b0ec2eef4acc8d7589e525f469d6cbc47f138803f4d5b495f3ad439d43a2ca5d4ca2ff0e7640f1
SSDEEP 98304:H+zn2M6MkLClncZx9aq0btXtGg+p2sWuJ:In25l2lox9apXUg+EPuJ
MD5 SHA1 SHA512 SSDEEP

Score

3^/10

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious use of SetWindowsHookEx 4 IoCs

pid	Process
2988	Jennie_Finch_Screensaver.scr
2988	Jennie_Finch_Screensaver.scr
2988	Jennie_Finch_Screensaver.scr
2988	Jennie_Finch_Screensaver.scr

C:\Users\Admin\AppData\Local\Temp\$SYSDIR\Jennie_Finch_Screensaver.scr
"C:\Users\Admin\AppData\Local\Temp\$SYSDIR\Jennie_Finch_Screensaver.scr" /S
1⤵
- Suspicious use of SetWindowsHookEx
PID:2988

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --field-trial-handle=4268,i,11069752405888604640,8928124405695604965,262144 --variations-seed-version --mojo-platform-channel-handle=3904 /prefetch:8
1⤵
PID:2448

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact