989ba3c5fdc837c561ec8aa69aed6a71fdeb4baebbeb4143866f6d9b0bc2af7a

Analysis

max time kernel
141s
max time network
124s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
30-12-2023 06:10

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

1524.exe
Size

2.6MB
MD5

4459ddf83ed9851879dc523027fa90c1
SHA1

437bc7d8fa8dbbc705bea51c0d6bc50375adf5ac
SHA256

03699477fd56eb1c9c0b5d5759455d64b0ab13685ed1c72c0d6236e693d515ca
SHA512

371af26edccc814b2765edbb192d3dec7c2e6dced19fe56a347f839938966e5e3e101ab0e9655da4db22a7ecf421be53afd9a77c25a0168825ac35e9f39fd634
SSDEEP

24576:Qelo5jh+9b8SL1lAdL5+FPI3YqOcHQSFablTmVfaxquGjHneFUJfKWqUQIvQeAMq:9l+h+1qs0Y/BTmFuGjHnevWDYj9Ebe

Score

3^/10

Malware Config

Signatures

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
2216	1524.exe

C:\Users\Admin\AppData\Local\Temp\1524.exe
"C:\Users\Admin\AppData\Local\Temp\1524.exe"
1⤵
- Suspicious behavior: GetForegroundWindowSpam
PID:2216

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2216-0-0x0000000000230000-0x0000000000231000-memory.dmp

Filesize
4KB

Download
memory/2216-1-0x0000000000400000-0x0000000000640000-memory.dmp

Filesize
2.2MB

Download
memory/2216-3-0x0000000000230000-0x0000000000231000-memory.dmp

Filesize
4KB

Download