e7a35879ce6b40812cfc0a93735ab59979395fce03280760bd4b08bf4cf852dc

Analysis

max time kernel
141s
max time network
123s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
05/01/2024, 00:58

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

6982.exe
Size

2.5MB
MD5

70f7988f6482be0bff11aecd657c9693
SHA1

6c2d44c5b8be0f2f04c87f01e31ca0b948af0ff5
SHA256

30632d53bf3309c353a21a260ea8b22107cbb8de38a97c2ccc38ff9b41bd19d3
SHA512

744ad603634b6434c0ce5720cf686d4a8b00636577785045a6c720944a545c7487227fef5d1eeeb06bfe2f6b1b2c112caf643ceb79ea50ab9bc3b7d2f76ae337
SSDEEP

49152:gl+h+1qs0Y/BTmnuGjHnevphptnWetAPDd:glK+19VerjHneTWemPDd

Score

3^/10

Malware Config

Signatures

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
2404	6982.exe

C:\Users\Admin\AppData\Local\Temp\6982.exe
"C:\Users\Admin\AppData\Local\Temp\6982.exe"
1⤵
- Suspicious behavior: GetForegroundWindowSpam
PID:2404

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2404-0-0x0000000000230000-0x0000000000231000-memory.dmp

Filesize
4KB

Download
memory/2404-1-0x0000000000400000-0x0000000000640000-memory.dmp

Filesize
2.2MB

Download
memory/2404-3-0x0000000000230000-0x0000000000231000-memory.dmp

Filesize
4KB

Download