b08320c9216b6c9f8d9f71c9fcf7fbef67a64aa993fb2acb07c53c12a6fd47f9

Analysis

max time kernel
141s
max time network
125s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
13/02/2024, 08:31

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

5711.exe
Size

3.0MB
MD5

39848564d45c3318a34c79221343f359
SHA1

748a09996e43854e5005ed6308f6a709cd99c345
SHA256

e6889ef54050e642a2d275f140f473593ba27073d3b86593be84acb909a8a010
SHA512

6c2692ccd81f3300f374de013cb1ff27ed6166d6379bdf70535872a31fb101f51756cebd1778de95385c4a519625c8a434dd8eb96724b731a6c7ac4c50726e3f
SSDEEP

49152:8l+h+1qs0Y/BTmXuGjHnevHGiejChz32PW9PLzCS3:8lK+19VOrjHne1e6V3

Score

3^/10

Malware Config

Signatures

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
2452	5711.exe

C:\Users\Admin\AppData\Local\Temp\5711.exe
"C:\Users\Admin\AppData\Local\Temp\5711.exe"
1⤵
- Suspicious behavior: GetForegroundWindowSpam
PID:2452

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2452-0-0x0000000000230000-0x0000000000231000-memory.dmp

Filesize
4KB

Download
memory/2452-1-0x0000000000400000-0x0000000000640000-memory.dmp

Filesize
2.2MB

Download
memory/2452-3-0x0000000000230000-0x0000000000231000-memory.dmp

Filesize
4KB

Download