853cb2ed91e96a6125613d04d1dd1344fb2e50611338d4a941729322e70d7d84

Analysis

max time kernel
141s
max time network
126s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
10-01-2024 16:08

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

244.exe
Size

2.8MB
MD5

3a279993f3347959fac31bc15cd09ffe
SHA1

5de03501f22451c7d1810864e216536e35b15711
SHA256

e28945230b3298017c5299b7619f62f3e5b3bb49d073a903f5684483869c3093
SHA512

eec061fba7a744cd15fb99174c3f31f68b14b75cbb7c039fb9de1ed40caddd30049941d07da6b02c6f5fe0231c48183d1530d86e1e364944529ec193932a2a9b
SSDEEP

49152:jl+h+1qs0Y/BTmGuGjHnevIvgIbsXLFYCe:jlK+19VjrjHne4g5w

Score

3^/10

Malware Config

Signatures

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
828	244.exe

C:\Users\Admin\AppData\Local\Temp\244.exe
"C:\Users\Admin\AppData\Local\Temp\244.exe"
1⤵
- Suspicious behavior: GetForegroundWindowSpam
PID:828

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/828-0-0x00000000001C0000-0x00000000001C1000-memory.dmp

Filesize
4KB

Download
memory/828-1-0x0000000000400000-0x0000000000640000-memory.dmp

Filesize
2.2MB

Download
memory/828-3-0x00000000001C0000-0x00000000001C1000-memory.dmp

Filesize
4KB

Download