63a20e5d18dd67e61f475eb3f0cd21d2f12628ab491ea4f5a8160c8e43ee3c38

Analysis

max time kernel
140s
max time network
117s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
30/12/2023, 10:49

Target

5158.exe
Size

2.3MB
MD5

de1705e66c54c16f9f1f6f81c2f6789d
SHA1

c3c321548637a379fb1422ccdf10025f1a39caf3
SHA256

c8bc40059ec59b3126179c1070e04ee0d1d409d0d7eafa69896a34cc335ed4d8
SHA512

c8c70264b3a764aedcd76b6b2b78ab145cabe5ff62446faadf1a2f2c21b8660378dd5363e75b5e672a2a02381cc896bd5d5910f45f8b80588ba30b60da61f076
SSDEEP

24576:oelo5jh+9b8SL1lAdL5+FPI3YqOcHQSFablTmVfBxquGjHneFUJfKLaVrd:Vl+h+1qs0Y/BTmQuGjHnevLS

Score

3^/10

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
2800	5158.exe

C:\Users\Admin\AppData\Local\Temp\5158.exe
"C:\Users\Admin\AppData\Local\Temp\5158.exe"
1⤵
- Suspicious behavior: GetForegroundWindowSpam
PID:2800

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

memory/2800-0-0x0000000000230000-0x0000000000231000-memory.dmp

Filesize
4KB

Download
memory/2800-1-0x0000000000400000-0x0000000000640000-memory.dmp

Filesize
2.2MB

Download
memory/2800-3-0x0000000000230000-0x0000000000231000-memory.dmp

Filesize
4KB

Download