e6c6bd02fa5f256653f81e8a8ef13fabfbcc0ba75a1ee41a83afb2199ea11d57

Analysis

max time kernel
122s
max time network
125s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
26/03/2024, 11:23

Target

df0b07f04985180c92145e6c0dc094f4.exe
Size

3.5MB
MD5

df0b07f04985180c92145e6c0dc094f4
SHA1

0fddec2a04a90f383e8ce6cda6b91567649dd046
SHA256

e6c6bd02fa5f256653f81e8a8ef13fabfbcc0ba75a1ee41a83afb2199ea11d57
SHA512

d759574710d66098ecec3210c29c36439cf8e6248abba5426dfbc9b0422257250c4386e9b1047eb2a4c8a6dec82b4f66a343a7d5eb3e7793331378754f7216f0
SSDEEP

98304:ysdEHG1jhlRi51c+v24cacgIOGhgYForbxKjhYlQCqM:kGjAckrMy/ci

Score

3^/10

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
2760	df0b07f04985180c92145e6c0dc094f4.exe

C:\Users\Admin\AppData\Local\Temp\df0b07f04985180c92145e6c0dc094f4.exe
"C:\Users\Admin\AppData\Local\Temp\df0b07f04985180c92145e6c0dc094f4.exe"
1⤵
- Suspicious behavior: GetForegroundWindowSpam
PID:2760

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact