49cf9b024465dcbe2b3c77374895d1c715f9ea53d46f8e4b2104ee245e01d706

Analysis

max time kernel
122s
max time network
126s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
28/01/2024, 11:39

Target
setup_akl.exe
Size 418KB
Sample240128-nss21ahgh4
SHA256 e2dc1886ca386f8717079b28cd52c1843de737ee24f2e521972730b9a6503c1f
MD5 f6699e0d27e915996f33ddf617c9bf6c
SHA1 74d69a9449331b90e46ae01577b4714b1a35391a
SHA512 104451a409acf12db353259e86b00e40b079e657f2c456a9f339977cd0a972dc23af16d2f85da12b6728294560b3cf13afe380dafe1a87ba62c81ff72b127c54
SSDEEP 12288:XDKLYe6zUbRrda8Kb9zoNVSbVhyzCe1PXcZgE:TKLuGJa8Kb9q+XI51PMZgE
MD5 SHA1 SHA512 SSDEEP

Score

3^/10

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
2880	setup_akl.exe

C:\Users\Admin\AppData\Local\Temp\setup_akl.exe
"C:\Users\Admin\AppData\Local\Temp\setup_akl.exe"
1⤵
- Suspicious behavior: GetForegroundWindowSpam
PID:2880

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact