3d008dd4e61761444e415cfcb82236c71e5a199b38492e53d8d3a7bf1d205d9f

Analysis

max time kernel
122s
max time network
126s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
16-03-2024 04:07

Target

cd109c901e0149d9fa176d2f8324fe56.exe
Size

3.7MB
MD5

cd109c901e0149d9fa176d2f8324fe56
SHA1

600aa58f790366d86d5231c1d2f9f2d4cdc5ec06
SHA256

3d008dd4e61761444e415cfcb82236c71e5a199b38492e53d8d3a7bf1d205d9f
SHA512

b1b952241436bc7aebc900e152900f4e3c78d28b2c46f189bf7dfcfceedf972994dd34bc07d664d57098718987e54889d93e37b706f840a1137336a7f9f62293
SSDEEP

49152:DFZId8u2urZoT+ZQgIzK/RPbaCL3FnNnO9hHrsOyupX+57q1pnqwdzfF8pPKRW/4:8dV2eqT+NJFb7FNnO9eOpQ2pqwh2VKkQ

Score

3^/10

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
1248	cd109c901e0149d9fa176d2f8324fe56.exe

C:\Users\Admin\AppData\Local\Temp\cd109c901e0149d9fa176d2f8324fe56.exe
"C:\Users\Admin\AppData\Local\Temp\cd109c901e0149d9fa176d2f8324fe56.exe"
1⤵
- Suspicious behavior: GetForegroundWindowSpam
PID:1248

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact