071b45b33b3fc86b5b2a19aff2c89e69dfa1ff5a001216e44797fb438e295b48

Analysis

max time kernel
156s
max time network
131s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
24/02/2024, 09:25

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

3486.exe
Size

2.7MB
MD5

5778a8e8ed78879a67067ef895d72c21
SHA1

3e0340b735017f1cf0355ef50bd1c3fc2212aa4a
SHA256

e35eb032cb64920115ce7d30cd59adf3a3fbf4b7516e42415c7e74a619c5de9b
SHA512

4e55a2283d09d85bf1e067606f0b5025da7c8971ecc25882b53cd37e7dbcd18ee5445f66ea58306377a4c977c65eb2740f4505c49173962f283719980553c646
SSDEEP

24576:delo5jh+9b8SL1lAdL5+FPI3YqOcHQSFablTmVffxquGjHneFUJfKfyYANS8ggyU:4l+h+1qs0Y/BTmKuGjHnevfvUhGzzl1S

Score

3^/10

Malware Config

Signatures

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
2912	3486.exe

C:\Users\Admin\AppData\Local\Temp\3486.exe
"C:\Users\Admin\AppData\Local\Temp\3486.exe"
1⤵
- Suspicious behavior: GetForegroundWindowSpam
PID:2912

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2912-0-0x0000000000230000-0x0000000000231000-memory.dmp

Filesize
4KB

Download
memory/2912-1-0x0000000000400000-0x0000000000640000-memory.dmp

Filesize
2.2MB

Download
memory/2912-3-0x0000000000230000-0x0000000000231000-memory.dmp

Filesize
4KB

Download