04a032c1ae84048a22652e652dcdc8b6aa1e3c2e265b186b1b83ca28154ff5f8

Analysis

max time kernel
140s
max time network
33s
platform
windows7_x64
resource
win7-20230220-en
resource tags

arch:x64arch:x86image:win7-20230220-enlocale:en-usos:windows7-x64system
submitted
09-06-2023 04:17

Target

04a032c1ae84048a22652e652dcdc8b6aa1e3c2e265b186b1b83ca28154ff5f8.exe
Size

848KB
MD5

c478f32d3472737dbeddee23df96e12b
SHA1

b6c7ae1568a3741a8776477c3f770a40cf051768
SHA256

04a032c1ae84048a22652e652dcdc8b6aa1e3c2e265b186b1b83ca28154ff5f8
SHA512

ef068a2ca013ca35497d48184d70c001ff6183a18e6aa376cae00e7369fd6100819cd43899633f95d142b8c7f2d532d727139e10bdf486b743b520e51b871486
SSDEEP

24576:7+LwElwdu101hwk17Zk+A5AzEcuCel9kYc:6LL2u1qhw67Zk3y4cuF3c

Score

3^/10

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082
Suspicious behavior: GetForegroundWindowSpam 1 IoCs

Processes:

04a032c1ae84048a22652e652dcdc8b6aa1e3c2e265b186b1b83ca28154ff5f8.exe

pid process

1740 04a032c1ae84048a22652e652dcdc8b6aa1e3c2e265b186b1b83ca28154ff5f8.exe

pid	process
1740	04a032c1ae84048a22652e652dcdc8b6aa1e3c2e265b186b1b83ca28154ff5f8.exe

C:\Users\Admin\AppData\Local\Temp\04a032c1ae84048a22652e652dcdc8b6aa1e3c2e265b186b1b83ca28154ff5f8.exe
"C:\Users\Admin\AppData\Local\Temp\04a032c1ae84048a22652e652dcdc8b6aa1e3c2e265b186b1b83ca28154ff5f8.exe"
1⤵
- Suspicious behavior: GetForegroundWindowSpam
PID:1740

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

memory/1740-57-0x0000000000400000-0x000000000067D000-memory.dmp

Filesize
2.5MB

Download
memory/1740-58-0x00000000003B0000-0x00000000003B1000-memory.dmp

Filesize
4KB

Download