5e72db5327c2e76f9c17c9531105c2acf64e351b214733d9b55d7b126561ea47

Analysis

max time kernel
141s
max time network
121s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
27/01/2024, 17:17

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

8859.exe
Size

2.8MB
MD5

38ff8ac360159dd68044b51d3a6947b5
SHA1

cec5342139e3d6fed4d4c1f14125c14aaa29710a
SHA256

477084b900431b983675911e8ba9d46eddcf2886515cbc8c8d14d842b59f7c98
SHA512

bcebdaeef6d6de848dbd38d001df7512d9773ba5382409dc17873fdc0b2327c117b0a920efdda972d6eccf13e6822de9a2ff5cde1d8c85d1269efc74477f9ee7
SSDEEP

49152:Ol+h+1qs0Y/BTmfuGjHnevKsHfubnH8yNs0:OlK+19VqrjHneZHunHP

Score

3^/10

Malware Config

Signatures

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
2408	8859.exe

C:\Users\Admin\AppData\Local\Temp\8859.exe
"C:\Users\Admin\AppData\Local\Temp\8859.exe"
1⤵
- Suspicious behavior: GetForegroundWindowSpam
PID:2408

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2408-0-0x0000000000230000-0x0000000000231000-memory.dmp

Filesize
4KB

Download
memory/2408-1-0x0000000000400000-0x0000000000640000-memory.dmp

Filesize
2.2MB

Download
memory/2408-3-0x0000000000230000-0x0000000000231000-memory.dmp

Filesize
4KB

Download