90bd86800a13de5d8b5bcc76ed14c4a765c77748c5746a119c120411df6b9ccd

Analysis

max time kernel
122s
max time network
123s
platform
windows7_x64
resource
win7-20240215-en
resource tags

arch:x64arch:x86image:win7-20240215-enlocale:en-usos:windows7-x64system
submitted
14-03-2024 04:28

Target

c7b0a4d4dc98801f9b51ea2fef75db99.exe
Size

3.9MB
MD5

c7b0a4d4dc98801f9b51ea2fef75db99
SHA1

e5c47f62ae2b8e528710cce4996f6175b6206ffe
SHA256

90bd86800a13de5d8b5bcc76ed14c4a765c77748c5746a119c120411df6b9ccd
SHA512

f8e853da565b5d9913f3121c68ead9cf136f9c9d7ab0aacaf725e7f0eb1d0249217aa8986434f7eb88ecdf191bc5ef1a74a1fb38c505caa32e6b25e9f1a63d44
SSDEEP

98304:CNpNs1ENvWuMmYKM/oxF/6hHr40tDbwGbLRt+eatgwh2VKkij:QsSKmYn/qp6N4QkGHWehzVKTj

Score

3^/10

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
1844	c7b0a4d4dc98801f9b51ea2fef75db99.exe

C:\Users\Admin\AppData\Local\Temp\c7b0a4d4dc98801f9b51ea2fef75db99.exe
"C:\Users\Admin\AppData\Local\Temp\c7b0a4d4dc98801f9b51ea2fef75db99.exe"
1⤵
- Suspicious behavior: GetForegroundWindowSpam
PID:1844

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact