5c685d9d3e7cfe464ffd124300940a358100c4bffd78d2e0043ac7c5f87fc7d7

Analysis

max time kernel
119s
max time network
123s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
03/02/2024, 00:53

Target
$PLUGINSDIR/bundle.exe
Size 1.4MB
Sample240203-a85h3sdbd5
SHA256 b3b32999ef8e7a5484245edbb431c3849654947b5a854c66afa7a1e1a4ec752a
MD5 49a32310628c30cbaa72336cc8099ab0
SHA1 a19d4faca995632c421eb03c64a51145f26ea259
SHA512 dd11731b4338bf879b73f8de7fee87d39955048b54daf7d07a4d2c41b391ddb912d40e3d84474c45bf2eb51001058bcc41cb5acc4ea630b9ff68b6a26df9cc6d
SSDEEP 24576:N2sFAbLXk1hD2LY+5MPIvdNn44CdGkL12u58Vvp6rsB+3xCGUwaj6DQ671WmQks:TebuWYpwvo4KGi12g8Vvp8sBjGUvj68l
MD5 SHA1 SHA512 SSDEEP

Score

3^/10

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
2496	bundle.exe

C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\bundle.exe
"C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\bundle.exe"
1⤵
- Suspicious behavior: GetForegroundWindowSpam
PID:2496

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact