07a2a58ed9f4ae63d29843e3a4151162cf30b7a970a17241932021d503f5d91d

Analysis

max time kernel
140s
max time network
120s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
12-01-2024 09:06

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

2523.exe
Size

3.8MB
MD5

a9524610226af1a9f4485117957f6c40
SHA1

1879df1aab720d0395356180ffbf721b8ecf3a27
SHA256

156275a2e2f79e8fcc8377730c9fb1d283cf506fe18c601b4337e0486df6e2ae
SHA512

9f98705d5411e7480d48cd26f67bed0a9ff3ae9421011c57cd363e4803eedb535cc34be815ef6bc7944207ea11ef714ca4f56a5aef448963a48f5cbea3be14f5
SSDEEP

98304:nlK+19V+rjHneaTzCqtA3/I+j3+gRwD8OH:TdUCqtAvIQxOH

Score

3^/10

Malware Config

Signatures

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
2652	2523.exe

C:\Users\Admin\AppData\Local\Temp\2523.exe
"C:\Users\Admin\AppData\Local\Temp\2523.exe"
1⤵
- Suspicious behavior: GetForegroundWindowSpam
PID:2652

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2652-0-0x0000000000230000-0x0000000000231000-memory.dmp

Filesize
4KB

Download
memory/2652-1-0x0000000000400000-0x0000000000640000-memory.dmp

Filesize
2.2MB

Download
memory/2652-3-0x0000000000230000-0x0000000000231000-memory.dmp

Filesize
4KB

Download