f5d8f3789b735ac3a21997797feaf45101ed73315e2a31434618f4f902b9317b

Analysis

max time kernel
15s
max time network
17s
platform
windows7_x64
resource
win7-20240708-en
resource tags

arch:x64arch:x86image:win7-20240708-enlocale:en-usos:windows7-x64system
submitted
18-12-2024 21:25

Target

PC远控测试-.exe
Size

2.6MB
MD5

b044b1bd454046017979442448a8e390
SHA1

ded32e08fde6485cd314872f0b5ee9d8b66233d2
SHA256

e351be996b4035fddffa0cbf6385568263edb38da2f6997487c15ac5fef3d905
SHA512

2334eeec197ff2ea07edb8ec165ad0fd3494d29adebfea4131c91081adb5705a9fc0f8683941869f7aaefc114857049001ca241aed585ec8dea42b2c76b305f8
SSDEEP

49152:VB38U5zFk1NhxsDT1T47R5FPfnH/EZUlimHQB5TxTE4CYn1bfHY2o:VtV74xswQBJxtf1b

Score

3^/10

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
2172	PC远控测试-.exe

C:\Users\Admin\AppData\Local\Temp\PC远控测试-.exe
"C:\Users\Admin\AppData\Local\Temp\PC远控测试-.exe"
1⤵
- Suspicious use of SetWindowsHookEx
PID:2172

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact