ea4059470303ade72f673d189c84825e68d85e027420e8a7bd5806342f4bb1fc

Analysis

max time kernel
143s
max time network
137s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
02/01/2024, 15:46

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

5461.exe
Size

2.3MB
MD5

124d3da839588cc5565edd3837e911fa
SHA1

500bbbc769dba66646640305b4149d29e5178187
SHA256

30becf81d6d6482fda221faf1c56e5a896606d9656a63355597ab2fee7777c26
SHA512

e31d15b525b7665134e3f8188a7e8ff6313448356eba7de6ff18465164ce31d877b685a7783ba9b66ea6649e9c3cae936e6505f60e91260693da41640a85b30d
SSDEEP

24576:aelo5jh+9b8SL1lAdL5+FPI3YqOcHQSFablTmVfBxquGjHneFUJfKTOhMV:Tl+h+1qs0Y/BTmguGjHnevTBV

Score

3^/10

Malware Config

Signatures

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
1252	5461.exe

C:\Users\Admin\AppData\Local\Temp\5461.exe
"C:\Users\Admin\AppData\Local\Temp\5461.exe"
1⤵
- Suspicious behavior: GetForegroundWindowSpam
PID:1252

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1252-0-0x00000000001C0000-0x00000000001C1000-memory.dmp

Filesize
4KB

Download
memory/1252-1-0x0000000000400000-0x0000000000640000-memory.dmp

Filesize
2.2MB

Download
memory/1252-3-0x00000000001C0000-0x00000000001C1000-memory.dmp

Filesize
4KB

Download