e807b87a49c9746869b72e5c0a0e19aa3faee2f9c39629104d9f4eb813190914

Analysis

max time kernel
141s
max time network
122s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
24-01-2024 14:21

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

6500.exe
Size

2.6MB
MD5

3ca2c97b25594cacdc72dcc84f605b0d
SHA1

16e8308c3240a71d996b2dc1d7627c49de47a593
SHA256

7263c5972c7b384aa44cc582b730d6a35102b1275de0f4a00976a0d69b5dd7af
SHA512

8008fc2951af6f5c4a09411008b838b96df80d220846cb9c6401e5eb4ce7dc908ad62b8c49ea9bdb0266d22b5ae227be9c3f315417c0a96465fefeae0cefb0f7
SSDEEP

24576:relo5jh+9b8SL1lAdL5+FPI3YqOcHQSFablTmVfIxquGjHneFUJfKpq18Ad0Ts2E:Sl+h+1qs0Y/BTmPuGjHnevpY8AdOW5

Score

3^/10

Malware Config

Signatures

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
2636	6500.exe

C:\Users\Admin\AppData\Local\Temp\6500.exe
"C:\Users\Admin\AppData\Local\Temp\6500.exe"
1⤵
- Suspicious behavior: GetForegroundWindowSpam
PID:2636

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2636-0-0x0000000000230000-0x0000000000231000-memory.dmp

Filesize
4KB

Download
memory/2636-1-0x0000000000400000-0x0000000000640000-memory.dmp

Filesize
2.2MB

Download
memory/2636-3-0x0000000000230000-0x0000000000231000-memory.dmp

Filesize
4KB

Download