6b0f452a2b1663d889ce334f4d0dca3958f238fef4e9a04b46731ec4fe768bd2

Analysis

max time kernel
140s
max time network
121s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
15/01/2024, 00:59

Target

5bb7872aac3aedf05a0573c3ba158dee.exe
Size

664KB
MD5

5bb7872aac3aedf05a0573c3ba158dee
SHA1

ebec15a23ba1535d6616f96b7e65aeda96650af3
SHA256

6b0f452a2b1663d889ce334f4d0dca3958f238fef4e9a04b46731ec4fe768bd2
SHA512

9deaaffc64baef73349dfccfba4624c5e9152602a8457028489487db2d2338ff281995656f1385d00226a66d4dbb3f2477c8cef102df2235a94d23e51ce6b0a9
SSDEEP

12288:x5vbY+4gvQr0/VQMKUoS0zioT6orq2CNfBOrAPSM:xxMvWr/id7vANfEru

Score

3^/10

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious behavior: EnumeratesProcesses 6 IoCs

C:\Users\Admin\AppData\Local\Temp\5bb7872aac3aedf05a0573c3ba158dee.exe
"C:\Users\Admin\AppData\Local\Temp\5bb7872aac3aedf05a0573c3ba158dee.exe"
1⤵
- Suspicious behavior: EnumeratesProcesses
PID:3032

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

memory/3032-0-0x0000000000230000-0x0000000000231000-memory.dmp

Filesize
4KB

Download
memory/3032-1-0x0000000000400000-0x00000000004AD000-memory.dmp

Filesize
692KB

Download
memory/3032-3-0x0000000000230000-0x0000000000231000-memory.dmp

Filesize
4KB

Download
memory/3032-7-0x0000000000400000-0x00000000004AD000-memory.dmp

Filesize
692KB

Download