141553028c051401a54aa63d0664ca15047d1e3c6da84c0cdcfa4e27bb5585ad

Analysis

max time kernel
141s
max time network
127s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
31/12/2023, 13:37

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

4633.exe
Size

2.4MB
MD5

aad9147e3734bc3beee8ffc762df27bc
SHA1

c93ed17136dd33358b5027f6c1b99b8587742fdf
SHA256

be845838f49931aaaa1485dc39ac54706f2b3c78eb059001868e8eb6db609f5c
SHA512

3a32a9c69f8e97559367efd3baadabd316f84ab32affe5eda513642ec70dcfa5b7808635003245f7deeb231e10d16c3831dfbfc5f31a20dfd99f2f437e456ba6
SSDEEP

24576:Selo5jh+9b8SL1lAdL5+FPI3YqOcHQSFablTmVfzxquGjHneFUJfKOiIbqmo9NK:Ll+h+1qs0Y/BTmWuGjHnevOmmu0

Score

3^/10

Malware Config

Signatures

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
2908	4633.exe

C:\Users\Admin\AppData\Local\Temp\4633.exe
"C:\Users\Admin\AppData\Local\Temp\4633.exe"
1⤵
- Suspicious behavior: GetForegroundWindowSpam
PID:2908

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2908-0-0x0000000000230000-0x0000000000231000-memory.dmp

Filesize
4KB

Download
memory/2908-1-0x0000000000400000-0x0000000000640000-memory.dmp

Filesize
2.2MB

Download
memory/2908-3-0x0000000000230000-0x0000000000231000-memory.dmp

Filesize
4KB

Download