662a060b9652e1162d36c508ec40e94d3329b3f1cc9464c5f5e5800580e72a83

Analysis

max time kernel
141s
max time network
125s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
02/02/2024, 23:54

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

9636.exe
Size

3.1MB
MD5

142ec4221d28b44540893bf121f73fe8
SHA1

09221fdbabc3ce2416ec6c4187c6b2722cdce2bf
SHA256

07d5b60384f5dce1ba2bf5593c109c30f36b14dc7d750ccfc0a7e2fc1777d632
SHA512

fb137f73cbf209e93fadc5447dc5d07ce4a21224c7251bbcec95e088ea7f4c93827712189aa4714f47be0db57e4f149e18a8f20b7e63e70fd8cd0b1402169931
SSDEEP

49152:dl+h+1qs0Y/BTm/uGjHnevYjX4njlj29bIzzu9CUuXiKFT:dlK+19VKrjHne8XGjd2yIKiKFT

Score

3^/10

Malware Config

Signatures

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
2336	9636.exe

C:\Users\Admin\AppData\Local\Temp\9636.exe
"C:\Users\Admin\AppData\Local\Temp\9636.exe"
1⤵
- Suspicious behavior: GetForegroundWindowSpam
PID:2336

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2336-0-0x0000000000230000-0x0000000000231000-memory.dmp

Filesize
4KB

Download
memory/2336-1-0x0000000000400000-0x0000000000640000-memory.dmp

Filesize
2.2MB

Download
memory/2336-3-0x0000000000230000-0x0000000000231000-memory.dmp

Filesize
4KB

Download