130b9b778967814876fa08f1cc18246191c48fad94d6035252d8315ede53540f

Analysis

max time kernel
121s
max time network
136s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
25/12/2023, 00:42

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

1dbb48c16b344c252dd355784d50556b.exe
Size

822KB
MD5

1dbb48c16b344c252dd355784d50556b
SHA1

39a2d57c41a9c388c6381d7957b24a3d8f4054a7
SHA256

130b9b778967814876fa08f1cc18246191c48fad94d6035252d8315ede53540f
SHA512

10c1e15017524cec2af7ac96055fba7388e2c2d25e50e6215ffe637bb558b3a73de7d2543f64fd7d07b4d85fef323d0ea77b9438018ad3d3f21bedefc8fa1283
SSDEEP

12288:9DuuddOz/jvPAcHtbL2uzpazN3uaLQLM7zil8l8InCAr1k5kBQ8ZvzVHA/72lrG:RueUr8cNbpzwB+a0LMSECKkWOAvzCYG

Score

3^/10

Malware Config

Signatures

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
1368	1dbb48c16b344c252dd355784d50556b.exe

C:\Users\Admin\AppData\Local\Temp\1dbb48c16b344c252dd355784d50556b.exe
"C:\Users\Admin\AppData\Local\Temp\1dbb48c16b344c252dd355784d50556b.exe"
1⤵
- Suspicious use of FindShellTrayWindow
PID:1368

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1368-0-0x0000000002B90000-0x0000000002B91000-memory.dmp

Filesize
4KB

Download
memory/1368-1-0x0000000002B90000-0x0000000002B91000-memory.dmp

Filesize
4KB

Download