9b3b40a8899c582069eb7cbcc7ee1b3fe6c5dccf8ca061f4327248c6a481e2de

Analysis

max time kernel
142s
max time network
129s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
31/12/2023, 13:51

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

6868.exe
Size

3.8MB
MD5

360a3eb8e10aecf41caddc8c026ebf4c
SHA1

872f75ecc140d9c27dcba8e21c3acc60b184b01b
SHA256

b775070eaccd6e952cb03142a6da6665b4307a57b5bb426b910fafe86d148c87
SHA512

d991ca4ca788b2d7aa3286de01ed60e26b72852c343ff1f247131e16c0e4d30285a3b49b237923c740b2688b87f964869f6f8e75522cde1d864f25a2261e9175
SSDEEP

98304:wlK+19VurjHneXNS1M6D2zM0BB347o55rpXEL:ydEUC43nfuL

Score

3^/10

Malware Config

Signatures

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
2184	6868.exe

C:\Users\Admin\AppData\Local\Temp\6868.exe
"C:\Users\Admin\AppData\Local\Temp\6868.exe"
1⤵
- Suspicious behavior: GetForegroundWindowSpam
PID:2184

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2184-0-0x0000000000230000-0x0000000000231000-memory.dmp

Filesize
4KB

Download
memory/2184-1-0x0000000000400000-0x0000000000640000-memory.dmp

Filesize
2.2MB

Download
memory/2184-3-0x0000000000230000-0x0000000000231000-memory.dmp

Filesize
4KB

Download