840d52d35ff84d5ca2b3967a4cc837c225da4352071e7ada61baeeceeaaba4b5

Analysis

max time kernel
125s
max time network
30s
platform
windows7_x64
resource
win7-20230220-en
resource tags

arch:x64arch:x86image:win7-20230220-enlocale:en-usos:windows7-x64system
submitted
14-06-2023 07:18

Target

setup.exe
Size

1.1MB
MD5

bd007ef0eee8010b56f262a94d4d79f4
SHA1

f09d4cf8a0241e561fb22238c72292c902608aec
SHA256

840d52d35ff84d5ca2b3967a4cc837c225da4352071e7ada61baeeceeaaba4b5
SHA512

8c24a9c10a2efcf02d60a7c83c7046631096ea026a05954657b706e68e1be747aa45fc31777ec035e99e53499a77d99ddabed1a9c375bcf8fa954e024a2223c4
SSDEEP

12288:yDPdsil5fCMggBIiMVO26kk+FG4eMb01JQntLOCVLoz6UD:yD1s2ts96kTbemVAh

Score

3^/10

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
1304	setup.exe

C:\Users\Admin\AppData\Local\Temp\setup.exe
"C:\Users\Admin\AppData\Local\Temp\setup.exe"
1⤵
- Suspicious behavior: GetForegroundWindowSpam
PID:1304

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact