4e6167b92ead041248e71d1fc00f0bafb923bb9160a5491f672f6def066c991f

Analysis

max time kernel
140s
max time network
117s
platform
windows7_x64
resource
win7-20240215-en
resource tags

arch:x64arch:x86image:win7-20240215-enlocale:en-usos:windows7-x64system
submitted
25/02/2024, 11:26

Target

3526.exe
Size

2.9MB
MD5

f7a1b89765c4ff5aac67ac86059a21ec
SHA1

1cf343379397350720ada0afb99842e714586534
SHA256

68692dd3d77276aae849159e73a7e132bc9784c47c3ed382ea3b4c65fa8cb787
SHA512

bb75c715ed5610f7201a5527d7286ba19dd56383c128e027d7ec47c6c5b41eea568eeba56ac714b659362029425d6dc9e1faa56a495fe149ae75a0d0b8233082
SSDEEP

49152:Jl+h+1qs0Y/BTmFuGjHnev7PfvJXrzaHtApfVYeo:JlK+19VQrjHnez5bzcapo

Score

3^/10

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
3016	3526.exe

C:\Users\Admin\AppData\Local\Temp\3526.exe
"C:\Users\Admin\AppData\Local\Temp\3526.exe"
1⤵
- Suspicious behavior: GetForegroundWindowSpam
PID:3016

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

memory/3016-0-0x0000000000230000-0x0000000000231000-memory.dmp

Filesize
4KB

Download
memory/3016-1-0x0000000000400000-0x0000000000640000-memory.dmp

Filesize
2.2MB

Download
memory/3016-3-0x0000000000230000-0x0000000000231000-memory.dmp

Filesize
4KB

Download