05aed4f4dac0e6e8497e12a0ebef0a76c3d163fa6460b1c6fe99ad80b4ac1b4e

Analysis

max time kernel
118s
max time network
124s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
15-01-2024 01:35

Target

597564129d5f2dd6570bedab62670532.exe
Size

629KB
MD5

597564129d5f2dd6570bedab62670532
SHA1

684827465b28b2384452375d693e3f38497e1623
SHA256

05aed4f4dac0e6e8497e12a0ebef0a76c3d163fa6460b1c6fe99ad80b4ac1b4e
SHA512

4450a68aea079f751973f37d0a19a2b9c0a043e81d8d63764ca198254945aff2964713912958421731bd7d19a2c0bb8b389d2f84900d65e8fd1e51735916f697
SSDEEP

12288:px4AxIeYtun6/OOs28lsoVXmm7KS98sM9lF5NbsqKWma1xoxdVti1A:px4ACc6bf8lsMXmmmSyxv51s+muoxdVz

Score

3^/10

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082
Suspicious use of FindShellTrayWindow 1 IoCs

Processes:

597564129d5f2dd6570bedab62670532.exe

pid process

1516 597564129d5f2dd6570bedab62670532.exe

pid	process
1516	597564129d5f2dd6570bedab62670532.exe

C:\Users\Admin\AppData\Local\Temp\597564129d5f2dd6570bedab62670532.exe
"C:\Users\Admin\AppData\Local\Temp\597564129d5f2dd6570bedab62670532.exe"
1⤵
- Suspicious use of FindShellTrayWindow
PID:1516

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Resource Development

Reconnaissance

memory/1516-0-0x0000000000880000-0x0000000000881000-memory.dmp

Filesize
4KB

Download
memory/1516-1-0x0000000000880000-0x0000000000881000-memory.dmp

Filesize
4KB

Download