e1f3b7cda628a65dd32f461fe2ac19f4494e48b7f7c8b6e14f4cebc77fbed2b9

Analysis

max time kernel
121s
max time network
140s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
02/01/2024, 17:17

Target

3e8e9573c6c879989263da245e633dd0.exe
Size

3.0MB
MD5

3e8e9573c6c879989263da245e633dd0
SHA1

815400861516b9fc63a99e56fd07ec1545801144
SHA256

e1f3b7cda628a65dd32f461fe2ac19f4494e48b7f7c8b6e14f4cebc77fbed2b9
SHA512

686898ffb28232aca8c5bdad874dbac63ed55c9024259ee8c6b45b83ec8cd679d4a78b51cd4d7e285082dfb2f46a98d84f67a4327e573a4de783b96eeecb47ea
SSDEEP

49152:Gq6K3TlL7tNgDO8Uap/M4eY1fe+naYpSLxevOgh/juhIwdzfF8pPKRW/BRSbs:GtUThHfahM4eQfecaYp8xevOKLuWwh2b

Score

3^/10

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
2416	3e8e9573c6c879989263da245e633dd0.exe

C:\Users\Admin\AppData\Local\Temp\3e8e9573c6c879989263da245e633dd0.exe
"C:\Users\Admin\AppData\Local\Temp\3e8e9573c6c879989263da245e633dd0.exe"
1⤵
- Suspicious behavior: GetForegroundWindowSpam
PID:2416

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact