a0dc7298c42cd2056b58106c02a47fbb7a9634c5b0117dc07e9c77a1cce75960

Analysis

max time kernel
122s
max time network
127s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
24/12/2023, 17:47

Target

09532d7b74802234d4cd6714c337e3bb.exe
Size

689KB
MD5

09532d7b74802234d4cd6714c337e3bb
SHA1

8ac5ade2360deb60d3f360b4636f818a5c3f6e14
SHA256

a0dc7298c42cd2056b58106c02a47fbb7a9634c5b0117dc07e9c77a1cce75960
SHA512

5ffd05d2507555c253c2aa62914a656ef0467af725b4193190be385fbaeafb7ebb6fb0b8b6045022962b822d8bb6729255004e1ff716cee3e086df08a8bb51ee
SSDEEP

12288:wTGh7v67JHad3ejT7xhIB2VHuIBSk4PXYmNwHM4GBiaJmarynDCOFtT:wTGhj67J6MhlH4XmsVAGXrynDCEtT

Score

3^/10

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
1900	09532d7b74802234d4cd6714c337e3bb.exe

C:\Users\Admin\AppData\Local\Temp\09532d7b74802234d4cd6714c337e3bb.exe
"C:\Users\Admin\AppData\Local\Temp\09532d7b74802234d4cd6714c337e3bb.exe"
1⤵
- Suspicious behavior: GetForegroundWindowSpam
PID:1900

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact