0a7b0c6c6dcb781ca7b70eca76d0691f9cfd5da0f0149185d15211de08769e35

Analysis

max time kernel
142s
max time network
158s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
30-12-2023 07:54

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

5251.exe
Size

2.5MB
MD5

cafc6bfaecf56e8b19de27c52b02f16e
SHA1

c567b998837ed1b544ee884765c0a7f8b8acb525
SHA256

5895ed9ba7d5b37beb305e94043ffca70591e77613551dd908d534c465750e8f
SHA512

df64c4c1ea68d3aaa36dbb105d8da127e3eeb35613372dcbe67cd041a49cbd4f6b8a60386cbef79ae801758e8c15fe292d125089f8a51bd76932351f5294b440
SSDEEP

49152:hl+h+1qs0Y/BTm2uGjHnevhuFVZrAIv2Gk:hlK+19VDrjHne8kIO1

Score

3^/10

Malware Config

Signatures

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
2764	5251.exe

C:\Users\Admin\AppData\Local\Temp\5251.exe
"C:\Users\Admin\AppData\Local\Temp\5251.exe"
1⤵
- Suspicious behavior: GetForegroundWindowSpam
PID:2764

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2764-0-0x0000000000230000-0x0000000000231000-memory.dmp

Filesize
4KB

Download
memory/2764-1-0x0000000000400000-0x0000000000640000-memory.dmp

Filesize
2.2MB

Download
memory/2764-3-0x0000000000230000-0x0000000000231000-memory.dmp

Filesize
4KB

Download