891611ddf98a04b12e9a47a83e4f4afcd0a8b308e63a08805ce40dfa39c5b66e

Analysis

max time kernel
141s
max time network
121s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
26/01/2024, 03:10

Target

3426.exe
Size

2.3MB
MD5

270efa4f8ab64063dfee46a28aa0cfd8
SHA1

14e8088d214e2132f09608513440ee371090271d
SHA256

9ffe3c361ae5c2b072071af38b7eeabee4b9e4dc1906eff2f05147157fb3f07f
SHA512

dcfd4dd71e1e57a78a417dcb2f120945997bc77e245dd423559e82ef7f46dc73291060315752888aec32fc3ad06fd58200ecb43fc223746a2b3981ff9056a61c
SSDEEP

24576:velo5jh+9b8SL1lAdL5+FPI3YqOcHQSFablTmVfBxquGjHneFUJfKoW7wevreYZH:ml+h+1qs0Y/BTmQuGjHnevoow2eYZ9F

Score

3^/10

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
1060	3426.exe

C:\Users\Admin\AppData\Local\Temp\3426.exe
"C:\Users\Admin\AppData\Local\Temp\3426.exe"
1⤵
- Suspicious behavior: GetForegroundWindowSpam
PID:1060

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

memory/1060-0-0x00000000001C0000-0x00000000001C1000-memory.dmp

Filesize
4KB

Download
memory/1060-1-0x0000000000400000-0x0000000000640000-memory.dmp

Filesize
2.2MB

Download
memory/1060-3-0x00000000001C0000-0x00000000001C1000-memory.dmp

Filesize
4KB

Download