e0d698b31712b735dab22840e7d75ce104feeeb515b79c125eb386d7c344c371

Analysis

max time kernel
141s
max time network
123s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
07-03-2024 10:27

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

10068.exe
Size

2.2MB
MD5

99c77e7d8806d5e17d5b743a651841f4
SHA1

637aec4c8ba3c5375beb690b2cf0f047d3c60846
SHA256

1d40ccd878f3f33e5d5319e3191371b9f825dacce79d104740d89bda6a3dc8f9
SHA512

56776d6e0e570fb20e6b8549c145d50e7c9338eaa3912b68cd902d449bd21399c0b5b80280e3278d6415656a7f2569bfa33c3ab71dd7aaf38c49aa0018cbc262
SSDEEP

24576:yelo5jh+9b8SL1lAdL5+FPI3YqOcHQSFablTmVfjxquGjHneFUJfKa5:rl+h+1qs0Y/BTm2uGjHnevY

Score

3^/10

Malware Config

Signatures

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
948	10068.exe

C:\Users\Admin\AppData\Local\Temp\10068.exe
"C:\Users\Admin\AppData\Local\Temp\10068.exe"
1⤵
- Suspicious behavior: GetForegroundWindowSpam
PID:948

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/948-0-0x0000000000230000-0x0000000000231000-memory.dmp

Filesize
4KB

Download
memory/948-1-0x0000000000400000-0x0000000000640000-memory.dmp

Filesize
2.2MB

Download
memory/948-3-0x0000000000230000-0x0000000000231000-memory.dmp

Filesize
4KB

Download