5065df74e755c01d511af83ee232e08be815b1590bb4d27a4ddbec40e6372047

Analysis

max time kernel
141s
max time network
122s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
27/01/2024, 15:06

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

4944.exe
Size

2.3MB
MD5

89c55a14a480bb255e1693289d38e5d7
SHA1

98af60031a4e045aaf90a5995d96d33b1c47a3f9
SHA256

d83eed949b31c5ff05f547a7e900184e862d76a7937910d77e8964eacb100138
SHA512

a4594814c852de3c84438ad2b33910e6c4447f7a67ccde4d5220a3e17a3b1850567259a83564a96f7b83eb07b86f54af2acb0bc1f2ec6cfe25d86dd8959834f5
SSDEEP

24576:Nelo5jh+9b8SL1lAdL5+FPI3YqOcHQSFablTmVf7xquGjHneFUJfKGCe8rqOcVY:ol+h+1qs0Y/BTm2uGjHnevGn8rqOcVY

Score

3^/10

Malware Config

Signatures

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
2004	4944.exe

C:\Users\Admin\AppData\Local\Temp\4944.exe
"C:\Users\Admin\AppData\Local\Temp\4944.exe"
1⤵
- Suspicious behavior: GetForegroundWindowSpam
PID:2004

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2004-0-0x0000000000230000-0x0000000000231000-memory.dmp

Filesize
4KB

Download
memory/2004-1-0x0000000000400000-0x0000000000640000-memory.dmp

Filesize
2.2MB

Download
memory/2004-3-0x0000000000230000-0x0000000000231000-memory.dmp

Filesize
4KB

Download