02e1bccb80a7dd17237b5114864ecd577354e02394b1a8feb3ee1a670fa13a8a

Analysis

max time kernel
148s
max time network
152s
platform
windows10-2004_x64
resource
win10v2004-20240709-en
resource tags

arch:x64arch:x86image:win10v2004-20240709-enlocale:en-usos:windows10-2004-x64system
submitted
19/07/2024, 06:36

Target

DefragMaster.exe
Size

734KB
MD5

c7610651e2d2c5f52b83049bc1f49bdf
SHA1

87667868eaf0ae9e63f4e2055ca9ff94cc2ef65d
SHA256

d600500efb55a2aea41878d81c92d921df220ed6add77c50dfac318468edad8f
SHA512

2f59ab02d32e32ce764145206cbecbbcc53d861f2ee177b15c5946f923b3d94c6332e329f5a9161e134dbad5135c74b48d6a15f0355c6e625b21d48e38cd170f
SSDEEP

12288:EVmVkW+5mW/isYQmxJncWYOmRL8noBoPooPovoWooPpS9yxkS4nO3lRkRc4YFwjp:EVWkzmW/isYXxuWYOmR8oBoPooPovoWS

Score

3^/10

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
4260	DefragMaster.exe
4260	DefragMaster.exe

C:\Users\Admin\AppData\Local\Temp\DefragMaster.exe
"C:\Users\Admin\AppData\Local\Temp\DefragMaster.exe"
1⤵
- Suspicious use of SetWindowsHookEx
PID:4260

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact