8689d4ffafb686a72c8a626d362227bb82cf58d73f57b883a1410fc0bd0bb0c0

Analysis

max time kernel
141s
max time network
119s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
29/12/2023, 20:22

Target

7531.exe
Size

2.5MB
MD5

31d077148351996e6a80cd1154148be5
SHA1

a7acab4a67617529c16d7a50792298a030e3e222
SHA256

d34ff9f597561c5de6278552c143e9d5280443dd64abf02bd306ba2d0a4da88e
SHA512

4a2816002da3360162a3969d66269ec5189b15c79b9eb954fc7f9cea51e0c56ef71c318d45784a3537a8140eae5874955eeed42a596d88d75bd4fb40fc03cd47
SSDEEP

24576:Selo5jh+9b8SL1lAdL5+FPI3YqOcHQSFablTmVf6xquGjHneFUJfKlWHbCrWUe5p:Ll+h+1qs0Y/BTmtuGjHnevleuxM

Score

3^/10

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
2148	7531.exe

C:\Users\Admin\AppData\Local\Temp\7531.exe
"C:\Users\Admin\AppData\Local\Temp\7531.exe"
1⤵
- Suspicious behavior: GetForegroundWindowSpam
PID:2148

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

memory/2148-0-0x0000000000230000-0x0000000000231000-memory.dmp

Filesize
4KB

Download
memory/2148-1-0x0000000000400000-0x0000000000640000-memory.dmp

Filesize
2.2MB

Download
memory/2148-3-0x0000000000230000-0x0000000000231000-memory.dmp

Filesize
4KB

Download