f5d8f3789b735ac3a21997797feaf45101ed73315e2a31434618f4f902b9317b

Analysis

max time kernel
95s
max time network
142s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
18/12/2024, 21:27

Target
PC远控测试-.exe
Size 2.6MB
Sample241218-1asdzaskd1
SHA256 e351be996b4035fddffa0cbf6385568263edb38da2f6997487c15ac5fef3d905
MD5 b044b1bd454046017979442448a8e390
SHA1 ded32e08fde6485cd314872f0b5ee9d8b66233d2
SHA512 2334eeec197ff2ea07edb8ec165ad0fd3494d29adebfea4131c91081adb5705a9fc0f8683941869f7aaefc114857049001ca241aed585ec8dea42b2c76b305f8
SSDEEP 49152:VB38U5zFk1NhxsDT1T47R5FPfnH/EZUlimHQB5TxTE4CYn1bfHY2o:VtV74xswQBJxtf1b
MD5 SHA1 SHA512 SSDEEP

Score

3^/10

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
4560	PC远控测试-.exe

C:\Users\Admin\AppData\Local\Temp\PC远控测试-.exe
"C:\Users\Admin\AppData\Local\Temp\PC远控测试-.exe"
1⤵
- Suspicious use of SetWindowsHookEx
PID:4560

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact