f46f7c75f9f80b6c90ac099ee7fe139f408c4f8e99516de7c7514c8358147e32

Analysis

max time kernel
141s
max time network
154s
platform
windows10-2004_x64
resource
win10v2004-20230220-en
resource tags

arch:x64arch:x86image:win10v2004-20230220-enlocale:en-usos:windows10-2004-x64system
submitted
08/06/2023, 13:05

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

f46f7c75f9f80b6c90ac099ee7fe139f408c4f8e99516de7c7514c8358147e32.exe
Size

2.1MB
MD5

d90f2b7b1f4ba5f137eb0ae98168d770
SHA1

5ae6c70694f2fae98edcd1e45c19a896a4aff52e
SHA256

f46f7c75f9f80b6c90ac099ee7fe139f408c4f8e99516de7c7514c8358147e32
SHA512

b0ab4e40d918b9bf6642951c0007f033c6303810e98458c6b31e924ea4e3dde8eec40df630ac4272b6cfb89f2a6c60c97bf7f2f9e9da242e1b9fe4319cbeb5a9
SSDEEP

24576:Uw1aMeEDW/AMnDfjClUM1LoCH016vRBP531yxqCC4XUWniPMyqHT/k0cmEcW/Xs/:ULDL2DLjfp36CQni0Y0WhHpTHTy5Fb

Score

3^/10

Malware Config

Signatures

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
1896	f46f7c75f9f80b6c90ac099ee7fe139f408c4f8e99516de7c7514c8358147e32.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
1896	f46f7c75f9f80b6c90ac099ee7fe139f408c4f8e99516de7c7514c8358147e32.exe

Suspicious use of SendNotifyMessage 1 IoCs

pid	Process
1896	f46f7c75f9f80b6c90ac099ee7fe139f408c4f8e99516de7c7514c8358147e32.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
1896	f46f7c75f9f80b6c90ac099ee7fe139f408c4f8e99516de7c7514c8358147e32.exe

C:\Users\Admin\AppData\Local\Temp\f46f7c75f9f80b6c90ac099ee7fe139f408c4f8e99516de7c7514c8358147e32.exe
"C:\Users\Admin\AppData\Local\Temp\f46f7c75f9f80b6c90ac099ee7fe139f408c4f8e99516de7c7514c8358147e32.exe"
1⤵
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of SetWindowsHookEx
PID:1896

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\I2013.ini

Filesize
124B

MD5
a6c534c1db465ce0461aadf5504847d0

SHA1
9be6c62ac44db4237a33db1b564b941aa9657a39

SHA256
af99fbf529533f7b56c1b9a09aac7f846271611fdd9d41bf5a4231ce8ad2f3d6

SHA512
11eef8fe2bcdfe948c1950a9c70269e5ea369b937dde0318ca74ab5d1953671c7495c7babc024d373d7782df28d8c347ef3e9ac03ce8bbc4a50f52aa23927bf2

Download Submit
memory/1896-133-0x0000000000830000-0x0000000000831000-memory.dmp

Filesize
4KB

Download
memory/1896-143-0x0000000000400000-0x0000000000648000-memory.dmp

Filesize
2.3MB

Download
memory/1896-144-0x0000000000830000-0x0000000000831000-memory.dmp

Filesize
4KB

Download
memory/1896-149-0x0000000000400000-0x0000000000648000-memory.dmp

Filesize
2.3MB

Download