f32ade747efbed7486284adb1b8ec38b4d593330369b6b52f4b3479f8b0688e3

Analysis

max time kernel
118s
max time network
122s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
18-01-2024 13:03

Target

656f95e6e6813ee88d54842ac9609e4b.exe
Size

4.1MB
MD5

656f95e6e6813ee88d54842ac9609e4b
SHA1

0295695057075c29180e356e091401f001584e4e
SHA256

f32ade747efbed7486284adb1b8ec38b4d593330369b6b52f4b3479f8b0688e3
SHA512

6f08451a4a0bed9e81aea89847f06396959f961f9c2571f5cdb35358b7b88da9365fa329612ae70403c26ddd24ce4eb5d02b65bbfae76e67f2ece99433547026
SSDEEP

98304:OslteTMw6fev+qOgroN/wweXtoeWoAW1FoQTvQfgL5NyI921pLYlQCqV:V8ww6fMtJ0NutrWi1OAvSgLebvF

Score

3^/10

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
2408	656f95e6e6813ee88d54842ac9609e4b.exe

C:\Users\Admin\AppData\Local\Temp\656f95e6e6813ee88d54842ac9609e4b.exe
"C:\Users\Admin\AppData\Local\Temp\656f95e6e6813ee88d54842ac9609e4b.exe"
1⤵
- Suspicious behavior: GetForegroundWindowSpam
PID:2408

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact