b36ce30bbfb0bd48d0f46b0aae9c98093adcf1a7c0a41939bb7bb5e6a26aa1c2

Analysis

max time kernel
119s
max time network
120s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
14-02-2024 01:57

Target

b36ce30bbfb0bd48d0f46b0aae9c98093adcf1a7c0a41939bb7bb5e6a26aa1c2.exe
Size

23.3MB
MD5

d3e9c9e07b0fdda94a112dd795666f06
SHA1

2ca3cb02fba5d92860ab15e334c1094e3db784f3
SHA256

b36ce30bbfb0bd48d0f46b0aae9c98093adcf1a7c0a41939bb7bb5e6a26aa1c2
SHA512

1e30a41da95effb5d79671eff639ca65062166bad58e9cc19d52af000ff2e674401de0b0959149b4327c4900144702ca5bdc847375acbdd27b1ee40445b9ff89
SSDEEP

393216:6LdwFOpR2bN4W9ASUrB9qDFuaVC4P+dRGlHZ4gnm+zm1rzCivghQ/gNQosA9F+:6LdwFOpYNV7UrB9qZBVCEiRGlp7qrphF

Score

3^/10

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
3012	b36ce30bbfb0bd48d0f46b0aae9c98093adcf1a7c0a41939bb7bb5e6a26aa1c2.exe

C:\Users\Admin\AppData\Local\Temp\b36ce30bbfb0bd48d0f46b0aae9c98093adcf1a7c0a41939bb7bb5e6a26aa1c2.exe
"C:\Users\Admin\AppData\Local\Temp\b36ce30bbfb0bd48d0f46b0aae9c98093adcf1a7c0a41939bb7bb5e6a26aa1c2.exe"
1⤵
- Suspicious behavior: GetForegroundWindowSpam
PID:3012

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact