546986777499c9ac65f46dec037f24ebc977c58faaf0e889a091acf8acfc7258

Analysis

max time kernel
143s
max time network
131s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
30-12-2023 02:53

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

7087.exe
Size

2.4MB
MD5

2606c9e3bc5013cda286b3495b92b461
SHA1

97eb314386faef247218c9efdd96d72134091721
SHA256

0377db0ce35e8ac6616657b7ec70727954c72f9b125336ca36604c665028d30f
SHA512

28f8314997b6b28487dd27b3fc0a1ea53ce328166d60dd0461ddb3856d1a3f8a8738f57e35c13c5d1ec63f6adf6a0054c3c22c7df54ed6d9b3e95bd6727544c8
SSDEEP

24576:xelo5jh+9b8SL1lAdL5+FPI3YqOcHQSFablTmVfaxquGjHneFUJfKQWekG0Gw2gL:sl+h+1qs0Y/BTmNuGjHnevQGUirx

Score

3^/10

Malware Config

Signatures

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
2168	7087.exe

C:\Users\Admin\AppData\Local\Temp\7087.exe
"C:\Users\Admin\AppData\Local\Temp\7087.exe"
1⤵
- Suspicious behavior: GetForegroundWindowSpam
PID:2168

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2168-0-0x00000000001C0000-0x00000000001C1000-memory.dmp

Filesize
4KB

Download
memory/2168-1-0x0000000000400000-0x0000000000640000-memory.dmp

Filesize
2.2MB

Download
memory/2168-3-0x00000000001C0000-0x00000000001C1000-memory.dmp

Filesize
4KB

Download