378c427a70f5e411348dd6585d36e8d083df52ecbb9f5a44d6f3e2f565af8077

Analysis

max time kernel
122s
max time network
126s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
06/03/2024, 08:41

Target

b6ff7a0f63a869d79c2a0f140ff1be5b.exe
Size

3.8MB
MD5

b6ff7a0f63a869d79c2a0f140ff1be5b
SHA1

0ce7d9595096d79a84cd54b1a67b148bd1e67a16
SHA256

378c427a70f5e411348dd6585d36e8d083df52ecbb9f5a44d6f3e2f565af8077
SHA512

bdb1962b6abc47713651e0951b2dc215410c395dc69b76056fb706ee5c1ab573ba5fd9146d26f4d694e5d3c2642eea4ee19bdec8b8dd9b7a4b94076bfb652a29
SSDEEP

98304:J0Srp54WFCV2fWQfnFuNhTZaqP1H76lwh2VKki5:eSr4Wu2fWauTRx76lzVKT5

Score

3^/10

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
2248	b6ff7a0f63a869d79c2a0f140ff1be5b.exe

C:\Users\Admin\AppData\Local\Temp\b6ff7a0f63a869d79c2a0f140ff1be5b.exe
"C:\Users\Admin\AppData\Local\Temp\b6ff7a0f63a869d79c2a0f140ff1be5b.exe"
1⤵
- Suspicious behavior: GetForegroundWindowSpam
PID:2248

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact