842774fad0e00fd214ce0d72f9003dcb75ee7dee637d0a7fa77cb36bf9f191bc

Analysis

max time kernel
120s
max time network
124s
platform
windows7_x64
resource
win7-20240220-en
resource tags

arch:x64arch:x86image:win7-20240220-enlocale:en-usos:windows7-x64system
submitted
24/02/2024, 03:57

Target

a0e368bf4c4a6c276126224f70d6ad08.exe
Size

107KB
MD5

a0e368bf4c4a6c276126224f70d6ad08
SHA1

b723152eefe33f9d77d8df6a35a6b9de89d47ab7
SHA256

842774fad0e00fd214ce0d72f9003dcb75ee7dee637d0a7fa77cb36bf9f191bc
SHA512

8617c7a8fff523e17954e48cd3afff63c4acac9045d97b4cc7c22fb0731b04f3f932c646aeace9bc4b1449d66374eabb99d48dd2bd3b74225e4657b1a4079f5b
SSDEEP

3072:LizjyRDxUhKAfckJp1Xn2Jz4eFttpyLgEAmFeX:mjyRDxUhYW14D3puhFa

Score

3^/10

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
2868	a0e368bf4c4a6c276126224f70d6ad08.exe

C:\Users\Admin\AppData\Local\Temp\a0e368bf4c4a6c276126224f70d6ad08.exe
"C:\Users\Admin\AppData\Local\Temp\a0e368bf4c4a6c276126224f70d6ad08.exe"
1⤵
- Suspicious behavior: GetForegroundWindowSpam
PID:2868

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact