95068ba50db5eebb71e8a1601b4745fb17b5a6ffc381994709d4b1abb7e0b3ec

Analysis

max time kernel
129s
max time network
31s
platform
windows7_x64
resource
win7-20230621-en
resource tags

arch:x64arch:x86image:win7-20230621-enlocale:en-usos:windows7-x64system
submitted
02/07/2023, 01:51

Target

977f6bc76e6d7a02366e8af5d3cac2aa.exe
Size

97.6MB
MD5

977f6bc76e6d7a02366e8af5d3cac2aa
SHA1

f341b681115c49c79dc24670ff31015c5bc31fe4
SHA256

95068ba50db5eebb71e8a1601b4745fb17b5a6ffc381994709d4b1abb7e0b3ec
SHA512

7ba1fbff66d71c16d5a643b861e370a23ebb99deeb923a96883f7bc27cce553727f7f24a1f91ecd5914ced94c5f1fcccdc9771ec56dbc62a7adfcb179fa0307c
SSDEEP

3145728:6QAPCRrlpr73GrShtGO4fc5NAagkx+LdPfne:aqZv/3EslQc5NAaGd+

Score

7^/10

Loads dropped DLL 1 IoCs

pid	Process
2004	977f6bc76e6d7a02366e8af5d3cac2aa.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
2004	977f6bc76e6d7a02366e8af5d3cac2aa.exe

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

\Users\Admin\AppData\Local\Temp\nsy1FA4.tmp\System.dll

Filesize
12KB

MD5
cff85c549d536f651d4fb8387f1976f2

SHA1
d41ce3a5ff609df9cf5c7e207d3b59bf8a48530e

SHA256
8dc562cda7217a3a52db898243de3e2ed68b80e62ddcb8619545ed0b4e7f65a8

SHA512
531d6328daf3b86d85556016d299798fa06fefc81604185108a342d000e203094c8c12226a12bd6e1f89b0db501fb66f827b610d460b933bd4ab936ac2fd8a88

Download Submit