574d3a13874d3dfb349f30a056da918d80917b31c75046e751fc3644db121bdc

Analysis

max time kernel
120s
max time network
120s
platform
windows7_x64
resource
win7-20240220-en
resource tags

arch:x64arch:x86image:win7-20240220-enlocale:en-usos:windows7-x64system
submitted
05/03/2024, 20:39

Target

574d3a13874d3dfb349f30a056da918d80917b31c75046e751fc3644db121bdc.exe
Size

67KB
MD5

8705f9c51b6f76bf18c51e20d51a8892
SHA1

a462802e60f1703def8837dacabc77c7f98e2874
SHA256

574d3a13874d3dfb349f30a056da918d80917b31c75046e751fc3644db121bdc
SHA512

ff370098eeae163f7720716eeaf9eed6982f9659dd0b14eca2dccc7581d49d98dc69feef98276f393ceaaef64d49cf9a59c878ecb5b626879bfbd90cfb853580
SSDEEP

1536:rferrLkSRoe8C4UZsys0Dh1duq4Romu/7q72fFI+PlE:rfi3k+oWDBDh1duq45L72uWlE

Score

3^/10

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
2008	574d3a13874d3dfb349f30a056da918d80917b31c75046e751fc3644db121bdc.exe

C:\Users\Admin\AppData\Local\Temp\574d3a13874d3dfb349f30a056da918d80917b31c75046e751fc3644db121bdc.exe
"C:\Users\Admin\AppData\Local\Temp\574d3a13874d3dfb349f30a056da918d80917b31c75046e751fc3644db121bdc.exe"
1⤵
- Suspicious behavior: GetForegroundWindowSpam
PID:2008

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact