f46f7c75f9f80b6c90ac099ee7fe139f408c4f8e99516de7c7514c8358147e32

Analysis

max time kernel
140s
max time network
31s
platform
windows7_x64
resource
win7-20230220-en
resource tags

arch:x64arch:x86image:win7-20230220-enlocale:en-usos:windows7-x64system
submitted
08/06/2023, 13:05

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

f46f7c75f9f80b6c90ac099ee7fe139f408c4f8e99516de7c7514c8358147e32.exe
Size

2.1MB
MD5

d90f2b7b1f4ba5f137eb0ae98168d770
SHA1

5ae6c70694f2fae98edcd1e45c19a896a4aff52e
SHA256

f46f7c75f9f80b6c90ac099ee7fe139f408c4f8e99516de7c7514c8358147e32
SHA512

b0ab4e40d918b9bf6642951c0007f033c6303810e98458c6b31e924ea4e3dde8eec40df630ac4272b6cfb89f2a6c60c97bf7f2f9e9da242e1b9fe4319cbeb5a9
SSDEEP

24576:Uw1aMeEDW/AMnDfjClUM1LoCH016vRBP531yxqCC4XUWniPMyqHT/k0cmEcW/Xs/:ULDL2DLjfp36CQni0Y0WhHpTHTy5Fb

Score

3^/10

Malware Config

Signatures

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
920	f46f7c75f9f80b6c90ac099ee7fe139f408c4f8e99516de7c7514c8358147e32.exe

Suspicious use of SendNotifyMessage 1 IoCs

pid	Process
920	f46f7c75f9f80b6c90ac099ee7fe139f408c4f8e99516de7c7514c8358147e32.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
920	f46f7c75f9f80b6c90ac099ee7fe139f408c4f8e99516de7c7514c8358147e32.exe

C:\Users\Admin\AppData\Local\Temp\f46f7c75f9f80b6c90ac099ee7fe139f408c4f8e99516de7c7514c8358147e32.exe
"C:\Users\Admin\AppData\Local\Temp\f46f7c75f9f80b6c90ac099ee7fe139f408c4f8e99516de7c7514c8358147e32.exe"
1⤵
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of SetWindowsHookEx
PID:920

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/920-54-0x0000000000230000-0x0000000000231000-memory.dmp

Filesize
4KB

Download
memory/920-64-0x0000000000400000-0x0000000000648000-memory.dmp

Filesize
2.3MB

Download
memory/920-65-0x0000000000230000-0x0000000000231000-memory.dmp

Filesize
4KB

Download
memory/920-74-0x0000000000400000-0x0000000000648000-memory.dmp

Filesize
2.3MB

Download