6cff16ec912b16c1b74d631c9aeda2e8ac3c8e62d4661677a0aa94a6f1916561

Analysis

max time kernel
119s
max time network
122s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
28-02-2024 07:21

Target

ab532b3da829930c77a8f7607c6e7b35.exe
Size

2.6MB
MD5

ab532b3da829930c77a8f7607c6e7b35
SHA1

e1b90be0e65d9feff0f1b265d104827df3e39768
SHA256

6cff16ec912b16c1b74d631c9aeda2e8ac3c8e62d4661677a0aa94a6f1916561
SHA512

b706e0cc8fdd35e0d29bc867292055c6a37191e56d50ee8a85180ef5a2c8b920b90723b2347cdba02e85a1a449b11c1e7c6d3976c96c3d0b5ac8219076b04241
SSDEEP

49152:C5DyEIPa9b/T9CblHmTDPCg4MKiN6icQbuR1HibwdzfF8pPKRW/BRSb8:CoyBCBGHEMpNoRowh2VKki8

Score

3^/10

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
2200	ab532b3da829930c77a8f7607c6e7b35.exe

C:\Users\Admin\AppData\Local\Temp\ab532b3da829930c77a8f7607c6e7b35.exe
"C:\Users\Admin\AppData\Local\Temp\ab532b3da829930c77a8f7607c6e7b35.exe"
1⤵
- Suspicious behavior: GetForegroundWindowSpam
PID:2200

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact