db670609ab7610e2468449fda760fa43223a63bbd266a53f2efd058a4feac20e

Analysis

max time kernel
124s
max time network
31s
platform
windows7_x64
resource
win7-20230220-en
resource tags

arch:x64arch:x86image:win7-20230220-enlocale:en-usos:windows7-x64system
submitted
13/06/2023, 17:36

Target

setup.exe
Size

472KB
MD5

ebfb2d7c6e33e5d0086036ed5d7dd95a
SHA1

4fa5502e721bdd4626f1ff966d33680b36673793
SHA256

db670609ab7610e2468449fda760fa43223a63bbd266a53f2efd058a4feac20e
SHA512

d60202c699532fd0b297623172c36a05b1d8e9d6b510c690dbf5cb454bca4ba7a9dd22b53b9aae5ebb4c57652af9bf999fedff6ec62ae91065b590136e02d447
SSDEEP

6144:tDRMxppSSVridF55EGOaJhaQXgFIaUHQWWiNLsqEIvooEE0WgpgYzHcp7u4d:tDGxppI1wQwFXQWiNScp7u4

Score

3^/10

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
1092	setup.exe

C:\Users\Admin\AppData\Local\Temp\setup.exe
"C:\Users\Admin\AppData\Local\Temp\setup.exe"
1⤵
- Suspicious behavior: GetForegroundWindowSpam
PID:1092

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact