4c3bfe0110373c35a21c09c75df33107ef42dcd1a5a32746e3392971d4a40cc3

Analysis

max time kernel
117s
max time network
118s
platform
windows7_x64
resource
win7-20231129-en
resource tags

arch:x64arch:x86image:win7-20231129-enlocale:en-usos:windows7-x64system
submitted
27/01/2024, 23:04

Target

7b857c19b65383476a2450b99f6d6e2d.exe
Size

3.5MB
MD5

7b857c19b65383476a2450b99f6d6e2d
SHA1

07ae3f08cfbe150503e964191b59a6ed81d3f669
SHA256

4c3bfe0110373c35a21c09c75df33107ef42dcd1a5a32746e3392971d4a40cc3
SHA512

d31d117c787dc5fde708b58e14f59cc1e024d252626d942509723c27bc71a3491c84a99c99f3c1487298748eca9eb0b297eb41d559e074451fa2da5dfbf26642
SSDEEP

98304:w6Saz+oKEOtj8QTQ0sHAsmcAmWyT52wh2VKkib:/Saz+fEOt8QN5s6w2zVKTb

Score

3^/10

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
1972	7b857c19b65383476a2450b99f6d6e2d.exe

C:\Users\Admin\AppData\Local\Temp\7b857c19b65383476a2450b99f6d6e2d.exe
"C:\Users\Admin\AppData\Local\Temp\7b857c19b65383476a2450b99f6d6e2d.exe"
1⤵
- Suspicious behavior: GetForegroundWindowSpam
PID:1972

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact