cbda294fd86c334705a89f205905543e3b98b36eba87f443348e169ddddaf229

Analysis

max time kernel
141s
max time network
126s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
12-01-2024 09:36

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

3695.exe
Size

2.5MB
MD5

fec5f64c9c2258aa130c859b01bf46e0
SHA1

a10a3390ef5278c4914fa212e221938cd2f425c8
SHA256

22aebec1a3e5bddbe3b4fa9914a74989f4628ced0bcd321e920112e7289a211f
SHA512

e0b75595dc2c076c4fc5aa9bdb2c8642facee426239f9de3044497677c61078ec0a13a62f790b527127f7ef2f43d2c45fa44a35b7a34dbc62ed9d251e7ee0d96
SSDEEP

49152:/l+h+1qs0Y/BTmnuGjHnevXgdSc/YYQRBZY:/lK+19VerjHneASi7

Score

3^/10

Malware Config

Signatures

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
2416	3695.exe

C:\Users\Admin\AppData\Local\Temp\3695.exe
"C:\Users\Admin\AppData\Local\Temp\3695.exe"
1⤵
- Suspicious behavior: GetForegroundWindowSpam
PID:2416

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2416-0-0x0000000000230000-0x0000000000231000-memory.dmp

Filesize
4KB

Download
memory/2416-1-0x0000000000400000-0x0000000000640000-memory.dmp

Filesize
2.2MB

Download
memory/2416-3-0x0000000000230000-0x0000000000231000-memory.dmp

Filesize
4KB

Download