9f9feb134cccf9e3459d5ef069492d087dc1fd3c55733a7b834ee774f4a8212d

Analysis

max time kernel
119s
max time network
133s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
13/03/2024, 15:43

Target

c640c84fb91ad5edaa497f3982f5831e.exe
Size

2.9MB
MD5

c640c84fb91ad5edaa497f3982f5831e
SHA1

aa32041426e6c16f1521abc1c2b6bdf369964fe6
SHA256

9f9feb134cccf9e3459d5ef069492d087dc1fd3c55733a7b834ee774f4a8212d
SHA512

90dd53e113ad4e486dfda258a6caa424f962f828b7420da8674724332dd55335493957ee46522b7239daafd8488587e600bee12d7d8553dda98c5274b45aa9ef
SSDEEP

49152:6b6zl/VxiJVJQt4QFc70kRkZ34FAGHprpfDbJi/koGyhmi3wdzfF8pPKRW/BRSbg:6b6NHie67qgAGHpBxi/kfEBwh2VKkig

Score

3^/10

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
2632	c640c84fb91ad5edaa497f3982f5831e.exe

C:\Users\Admin\AppData\Local\Temp\c640c84fb91ad5edaa497f3982f5831e.exe
"C:\Users\Admin\AppData\Local\Temp\c640c84fb91ad5edaa497f3982f5831e.exe"
1⤵
- Suspicious behavior: GetForegroundWindowSpam
PID:2632

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact