74dacaa2e469540ef3e655129552251e5f212e251d268f97c4ac72dc3c1f2122

Analysis

max time kernel
133s
max time network
146s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
02-02-2024 04:36

Target

74dacaa2e469540ef3e655129552251e5f212e251d268f97c4ac72dc3c1f2122.exe
Size

2.1MB
MD5

658724f696cbbd8e359b85c0324f89dd
SHA1

341d87bc20a75adbc306a03f55600badbe440b2f
SHA256

74dacaa2e469540ef3e655129552251e5f212e251d268f97c4ac72dc3c1f2122
SHA512

94a68a3410ea336d2521466a63387a8ac0d882408ae03cacb0b5639e3b1ae8fe4198c34372c3a4d617b2367d766e67f3d51348a1e42c241656b55539d48ec5b0
SSDEEP

49152:f3zeD9F6ETyEGJOfNf6sTcWBKfDdTSJL7:beDLNfNf91

Score

3^/10

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious behavior: EnumeratesProcesses 4 IoCs

C:\Users\Admin\AppData\Local\Temp\74dacaa2e469540ef3e655129552251e5f212e251d268f97c4ac72dc3c1f2122.exe
"C:\Users\Admin\AppData\Local\Temp\74dacaa2e469540ef3e655129552251e5f212e251d268f97c4ac72dc3c1f2122.exe"
1⤵
- Suspicious behavior: EnumeratesProcesses
PID:2132

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

C:\Users\Admin\AppData\Roaming\2345Pic\PdfEditor\config.ini

Filesize
34B

MD5
10525119bf2396b22b894e6362bb97f3

SHA1
85f9b33c226e966055041ed9ec0e4231a4b9559f

SHA256
632d7d9b3e21cfeff0931f95f0290f7aaf84a08ad5989509b609950e20da9491

SHA512
85ceb3fca5f7693ced72f1f41d164d81003b7165d1062f7b4ee704ec68b4878e6d7c083036a254f1d4a8f9a94eff1b8825862a4355afef34bc1b2a50ee46fb04

Download Submit
memory/2132-2-0x0000000000170000-0x0000000000171000-memory.dmp

Filesize
4KB

Download