d1ce9b1e98691d506d2e9e2b3c6d624dc72415ceb53cbc8ed587d89bab2c3d1b

Analysis

max time kernel
140s
max time network
122s
platform
windows7_x64
resource
win7-20240215-en
resource tags

arch:x64arch:x86image:win7-20240215-enlocale:en-usos:windows7-x64system
submitted
09/03/2024, 20:17

Target

4740.exe
Size

2.4MB
MD5

316fb767b5834ccc52e0b51be704a815
SHA1

ddbb291c7d24084445f6d6fae6fa3068292aa154
SHA256

18631a818bf5f71f40ce3a662d8a01a2e607c244bb83c4058c22cfe47e23dcff
SHA512

d6b901ec94b948561a6fae770a0a19b3f70e7f0f9ee3aa31377ce510afb00ffb70de05397837f211ffbb62e0fff89a2754e9be0ec872252fb2b90cd26be7d394
SSDEEP

24576:gelo5jh+9b8SL1lAdL5+FPI3YqOcHQSFablTmVfBxquGjHneFUJfKIGVh+B8byTn:Nl+h+1qs0Y/BTmguGjHnevIch+ucq8

Score

3^/10

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
3000	4740.exe

C:\Users\Admin\AppData\Local\Temp\4740.exe
"C:\Users\Admin\AppData\Local\Temp\4740.exe"
1⤵
- Suspicious behavior: GetForegroundWindowSpam
PID:3000

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

memory/3000-0-0x0000000000230000-0x0000000000231000-memory.dmp

Filesize
4KB

Download
memory/3000-1-0x0000000000400000-0x0000000000640000-memory.dmp

Filesize
2.2MB

Download
memory/3000-3-0x0000000000230000-0x0000000000231000-memory.dmp

Filesize
4KB

Download