d6e1f512f7c70786fe72a0b4a0ba3cfd6715d2819be28df38c102f2f81d08bde

Analysis

max time kernel
140s
max time network
123s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
29/12/2023, 21:55

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

2114.exe
Size

2.7MB
MD5

30498f746b2293399607745c690b1317
SHA1

58708bf5094b12db82e4b5e5026aa396b6551c2a
SHA256

f5cdecc540e1940153c3790f175694e78ef6f28b935e8bfdb93c3b0957c75974
SHA512

2757184b561eb7b71ae5c9d771ec944d0bd13c26cd75f335df90570071adf31e0d19d8fa8beff1834c43798f1de587941a70eebc746bb7e36d9899156438fd3c
SSDEEP

49152:al+h+1qs0Y/BTmAuGjHnevR9e8r9KzZI7:alK+19VZrjHnebe8BKzA

Score

3^/10

Malware Config

Signatures

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
2080	2114.exe

C:\Users\Admin\AppData\Local\Temp\2114.exe
"C:\Users\Admin\AppData\Local\Temp\2114.exe"
1⤵
- Suspicious behavior: GetForegroundWindowSpam
PID:2080

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2080-0-0x00000000001C0000-0x00000000001C1000-memory.dmp

Filesize
4KB

Download
memory/2080-1-0x0000000000400000-0x0000000000640000-memory.dmp

Filesize
2.2MB

Download
memory/2080-3-0x00000000001C0000-0x00000000001C1000-memory.dmp

Filesize
4KB

Download