78d8f36cf25044275f645992d92e830499143dd877d192ab72c068c4e0a89248

Analysis

max time kernel
127s
max time network
76s
platform
windows7_x64
resource
win7-20230703-en
resource tags

arch:x64arch:x86image:win7-20230703-enlocale:en-usos:windows7-x64system
submitted
06/07/2023, 18:37

Target

78d8f36cf25044275f645992d92e830499143dd877d192ab72c068c4e0a89248.exe
Size

508KB
MD5

4332b49a1699c9d02876ef75f11ad740
SHA1

b51024f725f12db3a9f8aa4ad803fab6969afad1
SHA256

78d8f36cf25044275f645992d92e830499143dd877d192ab72c068c4e0a89248
SHA512

80828768e839fceb63ff55c4ab4d19cd75517d296126647d747016e1052a0210b97185b2da5cb1f53ebf24bac3bf9d42a8200a23321c8336d5275524140c1f21
SSDEEP

12288:R2NUpFFGQfQw6Zx9se7XlY+MYodYvpSd83aInVeCIGBscGlbSZbHYCu96:wmpKQfQw6Zx9se7VY+MYiKSdWnVIGBG6

Score

3^/10

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
2172	78d8f36cf25044275f645992d92e830499143dd877d192ab72c068c4e0a89248.exe

C:\Users\Admin\AppData\Local\Temp\78d8f36cf25044275f645992d92e830499143dd877d192ab72c068c4e0a89248.exe
"C:\Users\Admin\AppData\Local\Temp\78d8f36cf25044275f645992d92e830499143dd877d192ab72c068c4e0a89248.exe"
1⤵
- Suspicious behavior: GetForegroundWindowSpam
PID:2172

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact