b465109103fcbe3a4ed84859fb0c517727ed863ec1c5a028162467258b0b9a40

Analysis

max time kernel
144s
max time network
129s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
14/02/2024, 14:50

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

1967.exe
Size

2.7MB
MD5

0de616937abfa9728515ceafc756a4da
SHA1

cbc9fda75d1a2d7ac2ea30cdcca90c848ab8f6aa
SHA256

a745c84a50cecf87021edc52fba265cb420fbe1c9ebb48f93ae8294046ecc4dc
SHA512

a8cb0b700737bb22094c476109ed9ff9dbf8f00078b59364ad13ab29fbd1cd7599160a763ff6213c0596d8f3f20afe884520891ead52d5a9ab4ff533604859ff
SSDEEP

49152:Nl+h+1qs0Y/BTmQuGjHnevhw68OPseXrw6tfhB8P:NlK+19VFrjHneq6DE6tfhB8P

Score

3^/10

Malware Config

Signatures

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
1308	1967.exe

C:\Users\Admin\AppData\Local\Temp\1967.exe
"C:\Users\Admin\AppData\Local\Temp\1967.exe"
1⤵
- Suspicious behavior: GetForegroundWindowSpam
PID:1308

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1308-0-0x00000000001C0000-0x00000000001C1000-memory.dmp

Filesize
4KB

Download
memory/1308-1-0x0000000000400000-0x0000000000640000-memory.dmp

Filesize
2.2MB

Download
memory/1308-3-0x00000000001C0000-0x00000000001C1000-memory.dmp

Filesize
4KB

Download