d50cdb7b4c5b9894b711d33ab566faf1141cdc57b388aa848f6a487917e5eeed

Analysis

max time kernel
121s
max time network
126s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
30/12/2023, 00:35

Target

08b4976906a1234fede2489c27384b93.exe
Size

6.3MB
MD5

08b4976906a1234fede2489c27384b93
SHA1

cc1dead967b6e16827eb3016158709b1f42bcac4
SHA256

d50cdb7b4c5b9894b711d33ab566faf1141cdc57b388aa848f6a487917e5eeed
SHA512

884936d398024be83a020e7e5964990dfee1dae53ea4fd815f4a6a328cacbcf31095dd8984f09fcec6ee0456cc57cddd0ef836f41dae6ad645bf2101e5451520
SSDEEP

98304:fKFP/HAs+dvTeoB01KRxujJUF62xjUNqdCdGImYKjc8oZX51Rk9Twh2VKkiE:fKF3WdvjRsVb2JpQmqX53SzVKTE

Score

3^/10

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
1616	08b4976906a1234fede2489c27384b93.exe

C:\Users\Admin\AppData\Local\Temp\08b4976906a1234fede2489c27384b93.exe
"C:\Users\Admin\AppData\Local\Temp\08b4976906a1234fede2489c27384b93.exe"
1⤵
- Suspicious behavior: GetForegroundWindowSpam
PID:1616

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact