f2ee79b503e21cf94f41f28f59f9ec6c3b07bd1a17df74bf51483d17295c160d

Analysis

max time kernel
140s
max time network
121s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
12/03/2024, 16:59

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

7034.exe
Size

2.3MB
MD5

1766ef029ada2f21c5d955c5a227ede0
SHA1

726a953c0c4b2e8c469b99520e22afdb3a2684e7
SHA256

2fb6b9ce07f4ce9aba7da0f0deb593f5f2dd863da1f07f168e3b2ace32fc4be3
SHA512

94546024760319c055c77a386e53807309c5d8be60cbfaf9bea16bbe553c46cc127823d544d3a31a8654fe28ab0e5d70a114dc7198cf3f14ec367f1d4e198bc3
SSDEEP

24576:3elo5jh+9b8SL1lAdL5+FPI3YqOcHQSFablTmVfqxquGjHneFUJfKj262Q+kW:ul+h+1qs0Y/BTm1uGjHnevjVw

Score

3^/10

Malware Config

Signatures

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
2120	7034.exe

C:\Users\Admin\AppData\Local\Temp\7034.exe
"C:\Users\Admin\AppData\Local\Temp\7034.exe"
1⤵
- Suspicious behavior: GetForegroundWindowSpam
PID:2120

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2120-0-0x00000000001C0000-0x00000000001C1000-memory.dmp

Filesize
4KB

Download
memory/2120-1-0x0000000000400000-0x0000000000640000-memory.dmp

Filesize
2.2MB

Download
memory/2120-3-0x00000000001C0000-0x00000000001C1000-memory.dmp

Filesize
4KB

Download