Analysis
-
max time kernel
142s -
max time network
126s -
platform
windows10-2004_x64 -
resource
win10v2004-20240709-en -
resource tags
-
submitted
26/07/2024, 04:38
General
-
Target
PhotoRescue Pro/PhotoRescuePro.exe
-
Size
2.5MB
-
MD5
777b61019224402deba1f49691449b21
-
SHA1
ec5917216195fb3a62d9bb75ae80c23f7592d1e7
-
SHA256
5271c0fb31fc8cdeba0fd7dc9375dcf8f2d1c896f04714ee181afc450d49975a
-
SHA512
91c642d042a59cee3325dd20c967cd4fa1fe8dd40ff37349207d35801bc8553c552392c52094e0eac20c39cf85f154e54297c53ec6103fee1a99d6965f106b58
-
SSDEEP
49152:roynyZVz8ISmMUixn0dgtGarLPsJHRkqrSY3:z4RRMUixn0dgtGaHPspRkqrS
Score
6/10
Malware Config
Signatures
-
Enumerates connected drives 3 TTPs 1 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
-
Suspicious use of SetWindowsHookEx 2 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\PhotoRescue Pro\PhotoRescuePro.exe"C:\Users\Admin\AppData\Local\Temp\PhotoRescue Pro\PhotoRescuePro.exe"1⤵
- Enumerates connected drives
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
464KB
-
Filesize
4KB